gyaansastra/cve-2022-30190Umfassende Analyse der CVE-2022-30190 (Follina MSDT-Schwachstelle) mit IOCs, Erkennungsregeln für SIEMs/EDR, YARA-Signaturen, Minderungsskripte und pädagogische Aufschlüsselung des Exploits aus der Perspektive eines Verteidigers.
Dieses Repository behandelt den Follina MSDT aus der Defender-Perspektive
Der Fehler ist eine Remote-Codeausführungsschwachstelle im Microsoft Windows Support Diagnostic Tool (MSDT), die von crazyman der Shadow Chaser Group gemeldet wurde. Microsoft verfolgt sie nun als CVE-2022-30190. Der Fehler betrifft alle Windows-Versionen, die noch Sicherheitsupdates erhalten (Windows 7+ und Server 2008+).
Wie der Sicherheitsforscher nao_sec herausfand, wird er von Bedrohungsakteuren verwendet, um bösartige PowerShell-Befehle über MSDT auszuführen, was Microsoft als Angriffe mit beliebiger Codeausführung (ACE) beschreibt, wenn Word-Dokumente geöffnet oder in der Vorschau angezeigt werden.
„Ein Angreifer, der diese Schwachstelle erfolgreich ausnutzt, kann beliebigen Code mit den Berechtigungen der aufrufenden Anwendung ausführen“, erklärt Microsoft.
Für die Bedrohungsjagd finden Sie die Sigma-Regel HIER
Nachfolgend sind die Erkennungsregeln, die weiter angepasst werden können. Dank an Bala Ganesh. Den vollständigen Artikel finden Sie HIER
MS Defender:
DeviceProcessEvents | where ((ProcessCommandLine contains "WINWORD.EXE") and (ProcessCommandLine contains "msdt.exe") and (ProcessCommandLine contains "sdiagnhost.exe" or ProcessCommandLine contains "csc.exe" or ProcessCommandLine contains "PCWDiagnostic" or ProcessCommandLine contains "IT_ReBrowserForFile" or ProcessCommandLine contains "IT_BrowserForFile" or ProcessCommandLine contains "conhost.exe"))
[Doc Malware]
alert.severity = 2
description = Detection (Rule ID: 74566a6a66aaasdq2ed)
cron_schedule = 0 * * * *
disabled = 1
is_scheduled = 1
is_visible = 1
dispatch.earliest_time = -60m@m
dispatch.latest_time = now
search = (source="WinEventLog:*" AND (CommandLine="*WINWORD.EXE*") AND (CommandLine="*msdt.exe*") AND (CommandLine="*sdiagnhost.exe*" OR CommandLine="*csc.exe*" OR CommandLine="*PCWDiagnostic*" OR CommandLine="*IT_ReBrowserForFile*" OR CommandLine="*IT_BrowserForFile*" OR CommandLine="*conhost.exe*"))
alert.suppress = 0
alert.track = 1
SELECT UTF8(payload) from events where LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' and ("Process CommandLine" ilike '%WINWORD.EXE%') and ("Process CommandLine" ilike '%msdt.exe%') and ("Process CommandLine" ilike '%sdiagnhost.exe%' or "Process CommandLine" ilike '%csc.exe%' or "Process CommandLine" ilike '%PCWDiagnostic%' or "Process CommandLine" ilike '%IT_ReBrowserForFile%' or "Process CommandLine" ilike '%IT_BrowserForFile%' or "Process CommandLine" ilike '%conhost.exe%')
(CommandLine.keyword:*WINWORD.EXE* AND CommandLine.keyword:*msdt.exe* AND CommandLine.keyword:(*sdiagnhost.exe* *csc.exe* *PCWDiagnostic* *IT_ReBrowserForFile* *IT_BrowserForFile* *conhost.exe*))
Sumologic
(_sourceCategory=*windows* AND (CommandLine = "*WINWORD.EXE*") AND (CommandLine = "*msdt.exe*") AND (CommandLine = "*sdiagnhost.exe*" OR CommandLine = "*csc.exe*" OR CommandLine = "*PCWDiagnostic*" OR CommandLine = "*IT_ReBrowserForFile*" OR CommandLine = "*IT_BrowserForFile*" OR CommandLine = "*conhost.exe*"))
(process.command_line:*WINWORD.EXE* AND process.command_line:*msdt.exe* AND process.command_line:(*sdiagnhost.exe* OR *csc.exe* OR *PCWDiagnostic* OR *IT_ReBrowserForFile* OR *IT_BrowserForFile* OR *conhost.exe*))
Die folgende Abfrage, beschrieben von Brent Murphy HIER, kann ebenfalls angewendet werden
process where event.type in ("start" , "process_created") and (process.pe.original_file_name : "msdt.exe" or process.name : "msdt.exe") and (process.parent.pe.original_file_name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe") or process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe"))
# office processes spawning msdt.exe
config case_sensitive = false timeframe = 30d
| dataset = xdr_data
| filter event_type = ENUM.PROCESS and action_process_image_command_line contains "msdt.exe" and actor_process_image_name in ("winword.exe", "powerpnt.exe", "excel.exe", "msaccess.exe","visio.exe","onenote.exe","powershell.exe")
| fields agent_hostname , action_process_image_command_line , action_process_image_path , actor_process_command_line , actor_process_image_path , causality_actor_process_image_path
# msdt.exe execution with suspicious argument
config case_sensitive = false timeframe = 30d
| dataset = xdr_data
| filter event_type = ENUM.PROCESS and action_process_image_command_line contains "msdt.exe" and
action_process_image_command_line contains "it_browseforfile"
| fields agent_hostname , action_process_image_command_line , action_process_image_path , actor_process_command_line , actor_process_image_path , causality_actor_process_image_path
index=main (ProcessRollup2 OR SyntheticProcessRollup2 OR ProcessBlocked*) ParentBaseFileName IN ("OUTLOOK.EXE","WINWORD.EXE","EXCEL.EXE") CommandLine="*msdt.exe*"
| table ComputerName ParentBaseFileName CommandLine FileName
index=main sourcetype=ProcessRollup* event_simpleName=ProcessRollup2
| search ParentBaseFileName IN (winword.exe, excel.exe, powerpnt.exe, outlook.exe)
| search FileName=msdt.exe
| table _time, aid, ComputerName, UserName, UserSid_readable, ParentBaseFileName, FileName, CommandLine
| lookup local=true aid_master aid OUTPUT AgentVersion, Version, MachineDomain, OU, SiteName
index=main sourcetype=ProcessRollup* event_simpleName=ProcessRollup2
| search FileName=msdt.exe
| eval FileName=lower(FileName)
| eval ParentBaseFileName=lower(ParentBaseFileName)
| stats dc(aid) as endpointCount, count(aid) as executionCount by FileName, ParentBaseFileName
| sort -executionCount
#Detects the exploitation of Follina Microsoft Code Execution vulnerability
SecurityEvent
| where EventID==4688
| where ParentProcessName has_any ('winword.exe','excel.exe','outlook.exe')
| where NewProcessName contains "msdt.exe" or CommandLine contains "msdt.exe"
| project TimeGenerated, NewProcessId, NewProcessName, ParentProcessName, CommandLine, EventID, Activity, Computer
#The below query could return false-positives please verify the output and modify the query according to your environment.
SecurityEvent
| where EventID==4688
| where ParentProcessName has_any ('sdiagnhost.exe', 'msdt.exe')
//| where NewProcessName contains "powershell" or NewProcessname contains "cmd.exe" //optional: you can include this line for directly finding powershell or cmd process spawns
| project TimeGenerated, NewProcessId, NewProcessName, ParentProcessName, CommandLine, EventID, Activity, Computer
⚠⚠BITTE VERWENDEN SIE DIESE NUR ZU FORSCHUNGS- UND LERNZWECKEN
reg delete HKEY_CLASSES_ROOT\ms-msdt /f
***Hinweis: Sie sollten den Inhalt dieses Schlüssels sichern, bevor Sie ihn löschen, damit er nach der Verfügbarkeit eines Patches wieder in die Registrierung eingefügt werden kann.
$ENV:ActivateWorkaround = "Yes"
if($ENV:ActivateWorkaround -eq "Yes") {
New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
Set-Item -Path "HKCR:\ms-msdt" -Value "URL:ms-msdt_bak"
Rename-Item -Path "HKCR:\ms-msdt" -newName "ms-msdt_bak"
} else {
New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
Rename-Item -Path "HKCR:\ms-msdt_bak" -newName "ms-msdt"
Set-Item -Path "HKCR:\ms-msdt" -Value "URL:ms-msdt"
}