gyaansastra/cve-2022-30190Análisis exhaustivo de CVE-2022-30190 (vulnerabilidad Follina MSDT) con IOCs, reglas de detección para SIEMs/EDR, firmas YARA, scripts de mitigación y desglose educativo del exploit desde la perspectiva de un defensor.
Este repositorio habla sobre el Follina MSDT desde la perspectiva de Defender
El bug es una vulnerabilidad de ejecución remota de código en la herramienta de diagnóstico de soporte de Microsoft (MSDT) reportada por crazyman del Shadow Chaser Group. Microsoft ahora la rastrea como CVE-2022-30190. El fallo afecta a todas las versiones de Windows que aún reciben actualizaciones de seguridad (Windows 7+ y Server 2008+).
Como descubrió el investigador de seguridad nao_sec, es utilizado por actores de amenazas para ejecutar comandos maliciosos de PowerShell a través de MSDT en lo que Redmond describe como ataques de Ejecución Arbitraria de Código (ACE) al abrir o previsualizar documentos de Word.
"Un atacante que explote con éxito esta vulnerabilidad puede ejecutar código arbitrario con los privilegios de la aplicación que realiza la llamada", explica Microsoft.
Para hacer Threat Hunt, puedes encontrar la regla Sigma AQUÍ
A continuación se presentan las reglas de detección que pueden afinarse aún más. Agradecimientos a Bala Ganesh. El artículo completo se puede encontrar AQUÍ
MS Defender:
DeviceProcessEvents | where ((ProcessCommandLine contains "WINWORD.EXE") and (ProcessCommandLine contains "msdt.exe") and (ProcessCommandLine contains "sdiagnhost.exe" or ProcessCommandLine contains "csc.exe" or ProcessCommandLine contains "PCWDiagnostic" or ProcessCommandLine contains "IT_ReBrowserForFile" or ProcessCommandLine contains "IT_BrowserForFile" or ProcessCommandLine contains "conhost.exe"))
[Doc Malware]
alert.severity = 2
description = Detection (Rule ID: 74566a6a66aaasdq2ed)
cron_schedule = 0 * * * *
disabled = 1
is_scheduled = 1
is_visible = 1
dispatch.earliest_time = -60m@m
dispatch.latest_time = now
search = (source="WinEventLog:*" AND (CommandLine="*WINWORD.EXE*") AND (CommandLine="*msdt.exe*") AND (CommandLine="*sdiagnhost.exe*" OR CommandLine="*csc.exe*" OR CommandLine="*PCWDiagnostic*" OR CommandLine="*IT_ReBrowserForFile*" OR CommandLine="*IT_BrowserForFile*" OR CommandLine="*conhost.exe*"))
alert.suppress = 0
alert.track = 1
SELECT UTF8(payload) from events where LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' and ("Process CommandLine" ilike '%WINWORD.EXE%') and ("Process CommandLine" ilike '%msdt.exe%') and ("Process CommandLine" ilike '%sdiagnhost.exe%' or "Process CommandLine" ilike '%csc.exe%' or "Process CommandLine" ilike '%PCWDiagnostic%' or "Process CommandLine" ilike '%IT_ReBrowserForFile%' or "Process CommandLine" ilike '%IT_BrowserForFile%' or "Process CommandLine" ilike '%conhost.exe%')
(CommandLine.keyword:*WINWORD.EXE* AND CommandLine.keyword:*msdt.exe* AND CommandLine.keyword:(*sdiagnhost.exe* *csc.exe* *PCWDiagnostic* *IT_ReBrowserForFile* *IT_BrowserForFile* *conhost.exe*))
Sumologic
(_sourceCategory=*windows* AND (CommandLine = "*WINWORD.EXE*") AND (CommandLine = "*msdt.exe*") AND (CommandLine = "*sdiagnhost.exe*" OR CommandLine = "*csc.exe*" OR CommandLine = "*PCWDiagnostic*" OR CommandLine = "*IT_ReBrowserForFile*" OR CommandLine = "*IT_BrowserForFile*" OR CommandLine = "*conhost.exe*"))
(process.command_line:*WINWORD.EXE* AND process.command_line:*msdt.exe* AND process.command_line:(*sdiagnhost.exe* OR *csc.exe* OR *PCWDiagnostic* OR *IT_ReBrowserForFile* OR *IT_BrowserForFile* OR *conhost.exe*))
La siguiente consulta descrita por Brent Murphy AQUÍ también se puede aplicar
process where event.type in ("start" , "process_created") and (process.pe.original_file_name : "msdt.exe" or process.name : "msdt.exe") and (process.parent.pe.original_file_name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe") or process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe"))
# office processes spawning msdt.exe
config case_sensitive = false timeframe = 30d
| dataset = xdr_data
| filter event_type = ENUM.PROCESS and action_process_image_command_line contains "msdt.exe" and actor_process_image_name in ("winword.exe", "powerpnt.exe", "excel.exe", "msaccess.exe","visio.exe","onenote.exe","powershell.exe")
| fields agent_hostname , action_process_image_command_line , action_process_image_path , actor_process_command_line , actor_process_image_path , causality_actor_process_image_path
# msdt.exe execution with suspicious argument
config case_sensitive = false timeframe = 30d
| dataset = xdr_data
| filter event_type = ENUM.PROCESS and action_process_image_command_line contains "msdt.exe" and
action_process_image_command_line contains "it_browseforfile"
| fields agent_hostname , action_process_image_command_line , action_process_image_path , actor_process_command_line , actor_process_image_path , causality_actor_process_image_path
index=main (ProcessRollup2 OR SyntheticProcessRollup2 OR ProcessBlocked*) ParentBaseFileName IN ("OUTLOOK.EXE","WINWORD.EXE","EXCEL.EXE") CommandLine="*msdt.exe*"
| table ComputerName ParentBaseFileName CommandLine FileName
index=main sourcetype=ProcessRollup* event_simpleName=ProcessRollup2
| search ParentBaseFileName IN (winword.exe, excel.exe, powerpnt.exe, outlook.exe)
| search FileName=msdt.exe
| table _time, aid, ComputerName, UserName, UserSid_readable, ParentBaseFileName, FileName, CommandLine
| lookup local=true aid_master aid OUTPUT AgentVersion, Version, MachineDomain, OU, SiteName
index=main sourcetype=ProcessRollup* event_simpleName=ProcessRollup2
| search FileName=msdt.exe
| eval FileName=lower(FileName)
| eval ParentBaseFileName=lower(ParentBaseFileName)
| stats dc(aid) as endpointCount, count(aid) as executionCount by FileName, ParentBaseFileName
| sort -executionCount
#Detects the exploitation of Follina Microsoft Code Execution vulnerability
SecurityEvent
| where EventID==4688
| where ParentProcessName has_any ('winword.exe','excel.exe','outlook.exe')
| where NewProcessName contains "msdt.exe" or CommandLine contains "msdt.exe"
| project TimeGenerated, NewProcessId, NewProcessName, ParentProcessName, CommandLine, EventID, Activity, Computer
#The below query could return false-positives please verify the output and modify the query according to your environment.
SecurityEvent
| where EventID==4688
| where ParentProcessName has_any ('sdiagnhost.exe', 'msdt.exe')
//| where NewProcessName contains "powershell" or NewProcessname contains "cmd.exe" //optional: you can include this line for directly finding powershell or cmd process spawns
| project TimeGenerated, NewProcessId, NewProcessName, ParentProcessName, CommandLine, EventID, Activity, Computer
⚠⚠POR FAVOR, USA LO SIGUIENTE SOLO CON FINES DE INVESTIGACIÓN Y APRENDIZAJE
reg delete HKEY_CLASSES_ROOT\ms-msdt /f
***Nota: Debes hacer una copia de seguridad del contenido de esta clave antes de eliminar el contenido para que pueda fusionarse nuevamente en el registro una vez que haya un parche disponible.
$ENV:ActivateWorkaround = "Yes"
if($ENV:ActivateWorkaround -eq "Yes") {
New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
Set-Item -Path "HKCR:\ms-msdt" -Value "URL:ms-msdt_bak"
Rename-Item -Path "HKCR:\ms-msdt" -newName "ms-msdt_bak"
} else {
New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
Rename-Item -Path "HKCR:\ms-msdt_bak" -newName "ms-msdt"
Set-Item -Path "HKCR:\ms-msdt" -Value "URL:ms-msdt"
}