Detects LNK files with suspicious Follina/CVE-2022-30190 strings

Hunt Hypothesis

This rule detects adversaries exploiting CVE-2022-30190 (Follina) by identifying LNK files containing suspicious Microsoft Office Strings that indicate potential remote code execution via msdt.exe. Proactive hunting for these artifacts in Azure Sentinel is critical because Follina attacks often bypass traditional email security controls and can lead to immediate lateral movement without requiring user interaction beyond opening a file.

YARA Rule

rule SUSP_LNK_Follina_Jun22 {
   meta:
      description = "Detects LNK files with suspicious Follina/CVE-2022-30190 strings"
      author = "Paul Hager"
      date = "2022-06-02"
      reference = "https://twitter.com/gossithedog/status/1531650897905950727"
      score = 75
      id = "d331d584-2ab3-5275-b435-6129c7291417"
   strings:
      $sa1 = "msdt.exe" ascii wide
      $sa2 = "msdt " ascii wide
      $sa3 = "ms-msdt:" ascii wide

      $sb = "IT_BrowseForFile=" ascii wide
   condition:
      filesize < 5KB and
      uint16(0) == 0x004c and uint32(4) == 0x00021401 and
      1 of ($sa*) and $sb
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects LNK files with suspicious Follina/CVE-2022-30190 strings rule, along with recommended filters:

Microsoft Office “Recent Files” Shortcuts: When users open documents via the “Recent” pane in Word or Excel, the application often generates temporary .lnk shortcuts pointing to the document location. These links frequently contain standard MSFT paths that may trigger string matches resembling Follina payloads due to similar directory structures (e.g., C:\Users\...\AppData\Local\Microsoft...).
- Filter/Exclusion: Exclude LNK files where the target path starts with C:\Users\ and the icon location is a standard system resource like %SystemRoot%\system32\shell32.dll.
IT Asset Management & Deployment Tools (e.g., SCCM, Intune): Enterprise deployment tools often create desktop shortcuts for newly installed applications or patches. These automated scripts generate .lnk files containing specific command strings that may include mshta.exe or similar execution paths, mimicking the Follina attack vector.
- Filter/Exclusion: Filter out LNK files created by known service accounts (e.g., DOMAIN\SCCM-Service, DOMAIN\Intune-Agent) and exclude those where the “Working Directory” matches the deployment tool’s root installation folder (e.g., C:\Program Files\Microsoft Configuration Manager).
Scheduled Task Execution for Reporting: Internal reporting jobs often rely on scheduled tasks that launch .lnk files to aggregate data from network shares. These links may point to internal report servers using paths containing strings like \\ServerName\Reports which can overlap with the suspicious string patterns defined in the rule.
- Filter/Exclusion: Exclude LNK files where the target path