Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploit

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging malicious Rich Text Format (RTF) attachments that trigger external resource downloads to exploit the MSHTML engine vulnerability identified in CVE-2022-30190 (Follina). Proactive hunting for this pattern within Azure Sentinel is critical because Follina enables fileless code execution via the msdt.exe process, allowing attackers to bypass traditional email security controls and establish a foothold without relying on executable files.

YARA Rule

rule SUSP_DOC_RTF_ExternalResource_EMAIL_Jun22 {
   meta:
      description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment"
      author = "Christian Burkard"
      date = "2022-06-01"
      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
      score = 70
      id = "3ddc838c-8520-5572-9652-8cb823f83e27"
   strings:
      /* <Relationships */
      $sa1 ="PFJlbGF0aW9uc2hpcH" ascii
      $sa2 ="xSZWxhdGlvbnNoaXBz" ascii
      $sa3 ="8UmVsYXRpb25zaGlwc" ascii
      /* TargetMode="External" */
      $sb1 ="VGFyZ2V0TW9kZT0iRXh0ZXJuYWwi" ascii
      $sb2 ="RhcmdldE1vZGU9IkV4dGVybmFsI" ascii
      $sb3 ="UYXJnZXRNb2RlPSJFeHRlcm5hbC" ascii
      /* .html!" */
      $sc1 ="Lmh0bWwhI" ascii
      $sc2 ="5odG1sIS" ascii
      $sc3 ="uaHRtbCEi" ascii
   condition:
      filesize < 400KB
      and 1 of ($sa*)
      and 1 of ($sb*)
      and 1 of ($sc*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

References

• https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the CVE-2022-30190 / Follina detection rule, including targeted filters and exclusions:

• Scenario: Microsoft Word “SmartArt” or “Content Control” Rendering

  • Context: When users open complex internal reports (e.g., HR onboarding packets or financial dashboards) created in Microsoft Word that utilize SmartArt graphics or Content Controls. These features often trigger the mso.dll to fetch external metadata or image resources from a local file share, mimicking the Follina behavior of downloading external objects via OLE.
  • Filter/Exclusion: Exclude alerts where the RTF file originates from internal mail servers (e.g., Exchange Online) and the downloaded resource URL points to an internal domain suffix (e.g., *.corp.internal or file://\\server\share). Additionally, filter out events where the process tree shows WINWORD.EXE spawning a child process that matches known Microsoft Office versions.

• Scenario: Automated Compliance Reporting via Scheduled Tasks

  • Context: A nightly scheduled job (e.g., using PowerShell or SCCM) generates and distributes compliance audit logs in RTF format to department heads. The automation script opens the RTF file programmatically to verify rendering, which triggers an external resource download from a central document repository server.
  • Filter/Exclusion: Create an exclusion based on the parent process name being TASKENG.EXE (Task Scheduler) or specific PowerShell service accounts (NT SERVICE\...). Filter out alerts where the file path matches known automation directories, such as C:\ProgramData\ComplianceEngine\Reports\.

• Scenario: Third-Party Document Management System (DMS) Integration

  • Context: Users accessing documents via a third-party DMS (e.g.,