Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation

Hunt Hypothesis

This hunt detects adversaries exploiting the Microsoft MSHTML engine vulnerability (CVE-2022-30190) by analyzing suspicious patterns within the document.xml.rels file of Office documents to identify Follina-style attacks that trigger remote code execution via mshta.exe. SOC teams should proactively hunt for this behavior in Azure Sentinel because Follina exploits often bypass traditional email security controls and can lead to rapid lateral movement without requiring user interaction or macro enablement.

YARA Rule

rule SUSP_Doc_WordXMLRels_May22 {
   meta:
      description = "Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation"
      author = "Tobias Michalski, Christian Burkard, Wojciech Cieslak"
      date = "2022-05-30"
      modified = "2022-06-20"
      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
      hash = "62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0"
      score = 70
      id = "304c4816-b2f6-5319-9fe9-8f74bdb82ad0"
   strings:
      $a1 = "<Relationships" ascii
      $a2 = "TargetMode=\"External\"" ascii

      $x1 = ".html!" ascii
      $x2 = ".htm!" ascii
      $x3 = "%2E%68%74%6D%6C%21" ascii /* encoded version of .html! */
      $x4 = "%2E%68%74%6D%21" ascii /* encoded version of .htm! */
   condition:
      filesize < 50KB
      and all of ($a*)
      and 1 of ($x*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the CVE-2022-30190 (Follina) detection rule, including suggested filters and exclusions:

Scenario: Automated Report Generation by Microsoft Power BI or SSRS
- Context: Enterprise reporting tools like Microsoft Power BI or SQL Server Reporting Services (SSRS) frequently generate .docx reports on a scheduled basis. These engines often embed complex relationship definitions in the document.xml.rels file that include specific XML namespaces and object IDs mimicking the Follina pattern, particularly when linking to external data sources or embedded charts.
- Filter/Exclusion: Exclude processes originating from PowerBIDesktop.exe, MSRSReportServer.exe, or wmiadap.exe. Additionally, filter out events where the parent process is a scheduled task (Task Scheduler) running under a dedicated service account (e.g., DOMAIN\svc-reporting).
Scenario: Document Conversion by Office 365 ProPlus Background Services
- Context: When users open or save documents via Microsoft Teams, OneDrive sync, or SharePoint Online integration, the background process OfficeClickToRun.exe (or WINWORD.EXE) performs real-time conversion and normalization. This often triggers a re-write of the document.xml.rels file with standard XML structures that match the detection signature for legitimate “mso” namespace usage.
- Filter/Exclusion: Create an exclusion rule for files created or modified by WINWORD.EXE, EXCEL.EXE, and POWERPNT.EXE where the user context is a standard interactive logon (not a service account). Filter based on the file path being within standard user document directories (e.g., %USERPROFILE%\Documents\OneDrive).
**Scenario: Automated Document Processing by RPA B