zavikhttak/follina-msdt-threat-investigation🔵 Threat analysis writeup for Follina (CVE-2022-30190) — Microsoft MSDT RCE zero-day exploited in the wild. Covers static analysis, VirusTotal, OSINT, MITRE ATT&CK T1059, and detection engineering using Windows Event ID 4688.
Microsoft MSDT Remote Code Execution zero-day — active exploitation investigation by MUHAMMAD ZAWAR KHATTAK
On a Friday evening, the team was alerted with a new RCE vulnerability actively being exploited in the wild. I was tasked with analyzing and researching the malicious sample to collect intelligence for the weekend team.
| Tool | Purpose |
|---|---|
| VirusTotal | Static analysis, file hashes, contacted URLs |
| Any.Run | Dynamic sandbox, MITRE ATT&CK mapping |
| CVE.org | Official vulnerability research |
| OSINT / GitHub | Detection rules, threat intelligence |
| Linux CLI | File hashing via sha1sum |
| # | Finding |
|---|---|
| SHA1 Hash | 06727ffda60359236a8029e0b3e8a0fd11c23313 |
| File Type | Office Open XML Document (disguised as .doc) |
| Malicious URL | Embedded in word/_rels/document.xml.rels |
| Process Killed | msdt.exe — Microsoft Support Diagnostic Tool |
| MITRE Technique | T1059 — Command and Scripting Interpreter |
| CVE | CVE-2022-30190 — Microsoft MSDT RCE |
ProcessName: msdt.exe
ParentProcessName: WINWORD.EXE
EventID: 4688
#BlueTeam #ThreatIntel #Follina #CVE-2022-30190 #MITRE #SOC #MalwareAnalysis #CyberSecurity