This hunt hypothesis targets adversaries leveraging the Follina exploit (CVE-2022-30190) to execute malicious RTF documents that trigger unauthorized external resource downloads via MSRTD.dll. A proactive search in Azure Sentinel is essential because this technique often bypasses traditional email security controls by exploiting a zero-day vulnerability, allowing attackers to establish initial access before standard detection mechanisms engage.
rule SUSP_Doc_RTF_ExternalResource_May22 {
meta:
description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation"
author = "Tobias Michalski, Christian Burkard"
date = "2022-05-30"
modified = "2022-05-31"
reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
score = 70
id = "71bb97e0-ec12-504c-a1f6-25039ac91c86"
strings:
$s1 = " LINK htmlfile \"http" ascii
$s2 = ".html!\" " ascii
condition:
uint32be(0) == 0x7B5C7274 and
filesize < 300KB and
all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 2 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the CVE-2022-30190 / Follina detection rule, including targeted filters and exclusions:
Scenario: Automated Report Generation via Microsoft Office Add-ins
OLEOBJECT entries pointing to internal web servers or CDN links for assets.MSACCESS.EXE, POWERBIDOC.EXE, or EXCEL.EXE AND the external resource URL belongs to trusted internal domains (e.g., *.corp.internal, *.sharepoint.com).Scenario: Scheduled Document Distribution via Microsoft Flow / Power Automate
svc-reporting, flow-bot). Additionally, exclude URLs matching the pattern https://*.microsoft.com or specific internal blob storage endpoints.Scenario: Legacy Document Migration and Archiving Jobs