Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation

Hunt Hypothesis

This hunt hypothesis identifies adversaries leveraging Microsoft Office documents to trigger msdt.exe execution via OLE objects, a primary indicator of CVE-2022-30190 (Follina) exploitation used for initial access and command execution. Proactively hunting for this behavior in Azure Sentinel is critical because Follina exploits a zero-day vulnerability that bypasses traditional email security controls, allowing attackers to establish persistence and execute arbitrary commands without requiring user interaction beyond opening the document.

YARA Rule

rule SUSP_PS1_Msdt_Execution_May22 {
   meta:
      description = "Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation"
      author = "Nasreddine Bencherchali, Christian Burkard"
      date = "2022-05-31"
      modified = "2025-03-21"
      reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
      score = 65
      id = "a1863582-87a2-5d07-a549-ef4a31bf0ed2"
   strings:
      $a = "PCWDiagnostic" ascii wide fullword
      $sa1 = "msdt.exe" ascii wide
      $sa2 = "msdt " ascii wide
      $sa3 = "ms-msdt" ascii wide

      $sb1 = "/af " ascii wide
      $sb2 = "-af " ascii wide
      $sb3 = "IT_BrowseForFile=" ascii wide

      /* OriginalFilename pcwrun.exe */
      $fp1 = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00
               46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00
               00 00 70 00 63 00 77 00 72 00 75 00 6E 00 2E 00
               65 00 78 00 65 00 }
      $fp2 = "FilesFullTrust" wide
      $fp3 = "Cisco Spark" ascii wide
      $fp4 = "author: " ascii
   condition:
      filesize < 10MB
      and $a
      and 1 of ($sa*)
      and 1 of ($sb*)
      and not 1 of ($fp*)
      // not JSON
      and not uint8(0) == 0x7B
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the CVE-2022-30190 / Follina detection rule, including suggested filters and exclusions:

Scenario: Microsoft Office Document Repair via “Open & Repair”
- Context: Users frequently encounter corrupted .docx or .xlsx files. When they right-click a file in Windows Explorer and select “Open & Repair”, Office internally invokes msdt.exe to handle the repair logic, which can trigger the rule if the invocation path looks like an external URL call.
- Suggested Filter: Exclude processes where the parent process is WINWORD.EXE, EXCEL.EXE, or POWERPNT.EXE and the command line contains keywords related to document repair (e.g., /repair).
Scenario: Scheduled System Health Diagnostics
- Context: Enterprise environments often utilize Windows Task Scheduler to run periodic health checks. A common task involves running msdt.exe with specific diagnostic IDs (e.g., DiagID=100) to check system performance or network connectivity, which mimics the Follina attack vector where a URL is passed as an argument.
- Suggested Filter: Create an exclusion for msdt.exe processes spawned by TASKENG.EXE (Task Scheduler) where the command line arguments match known diagnostic IDs used in your environment’s standard maintenance scripts.
Scenario: Endpoint Protection Agent Updates
- Context: Major Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black often utilize msdt.exe as a helper utility during their update cycles or when processing specific alert notifications that require user interaction.
- Suggested Filter: Whitelist msdt.exe executions where the