Detects suspicious pattern in msdt diagnostics log (e.g. CVE-2022-30190 / Follina exploitation)

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Microsoft Support Diagnostic Tool (MSDT) to execute remote code via Office document exploits, specifically mimicking the Follina vulnerability (CVE-2022-30190). Proactive hunting in Azure Sentinel is critical because this technique often bypasses traditional email security controls by triggering local process execution that can lead to immediate lateral movement or credential theft.

YARA Rule

rule SUSP_Msdt_Artefact_Jun22_2 {
   meta:
      description = "Detects suspicious pattern in msdt diagnostics log (e.g. CVE-2022-30190 / Follina exploitation)"
      author = "Christian Burkard"
      date = "2022-06-01"
      modified = "2022-07-29"
      reference = "https://twitter.com/nas_bench/status/1531718490494844928"
      score = 75
      id = "aa2a4bd7-2094-5652-a088-f58d0c7d3f62"
   strings:
      $a1 = "<ScriptError><Data id=\"ScriptName\" name=\"Script\">TS_ProgramCompatibilityWizard.ps1" ascii

      $x1 = "/../../" ascii
      $x2 = "$(Invoke-Expression" ascii
      $x3 = "$(IEX(" ascii nocase
   condition:
      uint32(0) == 0x6D783F3C /* <?xm */
      and $a1
      and 1 of ($x*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://twitter.com/nas_bench/status/1531718490494844928
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Follina (CVE-2022-30190) detection rule involving msdt.exe, along with recommended filters and exclusions:

• Scenario: Office 365/Word “Open in Word” via Outlook Add-ins

  • Context: Users frequently open documents embedded in Outlook emails or OneDrive links that utilize the Microsoft Support Diagnostic Tool (MSDT) for rendering rich media or interactive content. When a user clicks a link within an email body containing a specific Office add-in, msdt.exe is legitimately invoked by outlook.exe.
  • Filter/Exclusion: Exclude alerts where the parent process is OUTLOOK.EXE and the command line arguments contain standard Office 365 identifiers (e.g., ?file=..., ?source=outlook) rather than raw HTTP URLs pointing to external domains. Additionally, whitelist command lines containing msdt:// followed by internal domain suffixes (e.g., .contoso.com).

• Scenario: Scheduled Maintenance Jobs via Microsoft Endpoint Configuration Manager (SCCM/MECM)

  • Context: Enterprise IT teams often deploy scheduled tasks using SCCM to run diagnostics or update checks. These jobs frequently trigger msdt.exe with specific diagnostic IDs to gather system health data or validate Office installations during off-hours.
  • Filter/Exclusion: Create an exclusion for alerts where the parent process is CcmExec.exe (SCCM client) or Taskeng.exe (Windows Task Scheduler). Filter specifically for command lines containing known internal diagnostic IDs used by your organization’s maintenance scripts, such as msdt://id=... where the ID matches a documented list of internal maintenance tasks.

• Scenario: Microsoft Teams “Open in Desktop App” Functionality

  • **Context