gyaansastra/cve-2022-30190Análise abrangente do CVE-2022-30190 (vulnerabilidade Follina MSDT) com IOCs, regras de detecção para SIEMs/EDR, assinaturas YARA, scripts de mitigação e detalhamento educacional de exploração sob a perspectiva de um defensor.
Este repositório aborda a vulnerabilidade Follina no MSDT sob a perspetiva do Defender
A falha é uma vulnerabilidade de execução remota de código na Ferramenta de Diagnóstico de Suporte do Windows (MSDT), reportada por crazyman do Shadow Chaser Group. A Microsoft regista-a agora como CVE-2022-30190. O defeito afeta todas as versões do Windows que ainda recebem atualizações de segurança (Windows 7+ e Server 2008+).
Como o investigador de segurança nao_sec descobriu, é usada por agentes de ameaça para executar comandos maliciosos do PowerShell através do MSDT, no que a Redmond descreve como ataques de Execução Arbitrária de Código (ACE) ao abrir ou pré-visualizar documentos do Word.
"Um atacante que explore com sucesso esta vulnerabilidade pode executar código arbitrário com os privilégios da aplicação que a chama," explica a Microsoft.
Para fazer caça a ameaças, pode encontrar a regra Sigma AQUI
Abaixo estão as Regras de Deteção que podem ser posteriormente ajustadas. Agradecimentos a Bala Ganesh. O artigo completo pode ser encontrado AQUI
MS Defender:
DeviceProcessEvents | where ((ProcessCommandLine contains "WINWORD.EXE") and (ProcessCommandLine contains "msdt.exe") and (ProcessCommandLine contains "sdiagnhost.exe" or ProcessCommandLine contains "csc.exe" or ProcessCommandLine contains "PCWDiagnostic" or ProcessCommandLine contains "IT_ReBrowserForFile" or ProcessCommandLine contains "IT_BrowserForFile" or ProcessCommandLine contains "conhost.exe"))
[Doc Malware]
alert.severity = 2
description = Detection (Rule ID: 74566a6a66aaasdq2ed)
cron_schedule = 0 * * * *
disabled = 1
is_scheduled = 1
is_visible = 1
dispatch.earliest_time = -60m@m
dispatch.latest_time = now
search = (source="WinEventLog:*" AND (CommandLine="*WINWORD.EXE*") AND (CommandLine="*msdt.exe*") AND (CommandLine="*sdiagnhost.exe*" OR CommandLine="*csc.exe*" OR CommandLine="*PCWDiagnostic*" OR CommandLine="*IT_ReBrowserForFile*" OR CommandLine="*IT_BrowserForFile*" OR CommandLine="*conhost.exe*"))
alert.suppress = 0
alert.track = 1
SELECT UTF8(payload) from events where LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' and ("Process CommandLine" ilike '%WINWORD.EXE%') and ("Process CommandLine" ilike '%msdt.exe%') and ("Process CommandLine" ilike '%sdiagnhost.exe%' or "Process CommandLine" ilike '%csc.exe%' or "Process CommandLine" ilike '%PCWDiagnostic%' or "Process CommandLine" ilike '%IT_ReBrowserForFile%' or "Process CommandLine" ilike '%IT_BrowserForFile%' or "Process CommandLine" ilike '%conhost.exe%')
(CommandLine.keyword:*WINWORD.EXE* AND CommandLine.keyword:*msdt.exe* AND CommandLine.keyword:(*sdiagnhost.exe* *csc.exe* *PCWDiagnostic* *IT_ReBrowserForFile* *IT_BrowserForFile* *conhost.exe*))
Sumologic
(_sourceCategory=*windows* AND (CommandLine = "*WINWORD.EXE*") AND (CommandLine = "*msdt.exe*") AND (CommandLine = "*sdiagnhost.exe*" OR CommandLine = "*csc.exe*" OR CommandLine = "*PCWDiagnostic*" OR CommandLine = "*IT_ReBrowserForFile*" OR CommandLine = "*IT_BrowserForFile*" OR CommandLine = "*conhost.exe*"))
(process.command_line:*WINWORD.EXE* AND process.command_line:*msdt.exe* AND process.command_line:(*sdiagnhost.exe* OR *csc.exe* OR *PCWDiagnostic* OR *IT_ReBrowserForFile* OR *IT_BrowserForFile* OR *conhost.exe*))
A consulta abaixo descrita por Brent Murphy AQUI também pode ser aplicada
process where event.type in ("start" , "process_created") and (process.pe.original_file_name : "msdt.exe" or process.name : "msdt.exe") and (process.parent.pe.original_file_name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe") or process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe"))
# office processes spawning msdt.exe
config case_sensitive = false timeframe = 30d
| dataset = xdr_data
| filter event_type = ENUM.PROCESS and action_process_image_command_line contains "msdt.exe" and actor_process_image_name in ("winword.exe", "powerpnt.exe", "excel.exe", "msaccess.exe","visio.exe","onenote.exe","powershell.exe")
| fields agent_hostname , action_process_image_command_line , action_process_image_path , actor_process_command_line , actor_process_image_path , causality_actor_process_image_path
# msdt.exe execution with suspicious argument
config case_sensitive = false timeframe = 30d
| dataset = xdr_data
| filter event_type = ENUM.PROCESS and action_process_image_command_line contains "msdt.exe" and
action_process_image_command_line contains "it_browseforfile"
| fields agent_hostname , action_process_image_command_line , action_process_image_path , actor_process_command_line , actor_process_image_path , causality_actor_process_image_path
index=main (ProcessRollup2 OR SyntheticProcessRollup2 OR ProcessBlocked*) ParentBaseFileName IN ("OUTLOOK.EXE","WINWORD.EXE","EXCEL.EXE") CommandLine="*msdt.exe*"
| table ComputerName ParentBaseFileName CommandLine FileName
index=main sourcetype=ProcessRollup* event_simpleName=ProcessRollup2
| search ParentBaseFileName IN (winword.exe, excel.exe, powerpnt.exe, outlook.exe)
| search FileName=msdt.exe
| table _time, aid, ComputerName, UserName, UserSid_readable, ParentBaseFileName, FileName, CommandLine
| lookup local=true aid_master aid OUTPUT AgentVersion, Version, MachineDomain, OU, SiteName
index=main sourcetype=ProcessRollup* event_simpleName=ProcessRollup2
| search FileName=msdt.exe
| eval FileName=lower(FileName)
| eval ParentBaseFileName=lower(ParentBaseFileName)
| stats dc(aid) as endpointCount, count(aid) as executionCount by FileName, ParentBaseFileName
| sort -executionCount
#Detects the exploitation of Follina Microsoft Code Execution vulnerability
SecurityEvent
| where EventID==4688
| where ParentProcessName has_any ('winword.exe','excel.exe','outlook.exe')
| where NewProcessName contains "msdt.exe" or CommandLine contains "msdt.exe"
| project TimeGenerated, NewProcessId, NewProcessName, ParentProcessName, CommandLine, EventID, Activity, Computer
#The below query could return false-positives please verify the output and modify the query according to your environment.
SecurityEvent
| where EventID==4688
| where ParentProcessName has_any ('sdiagnhost.exe', 'msdt.exe')
//| where NewProcessName contains "powershell" or NewProcessname contains "cmd.exe" //optional: you can include this line for directly finding powershell or cmd process spawns
| project TimeGenerated, NewProcessId, NewProcessName, ParentProcessName, CommandLine, EventID, Activity, Computer
⚠⚠POR FAVOR, USE O SEGUINTE APENAS PARA FINS DE PESQUISA E APRENDIZAGEM
reg delete HKEY_CLASSES_ROOT\ms-msdt /f
***Note que deve fazer uma cópia de segurança do conteúdo desta chave antes de eliminar o conteúdo, para que possa ser mesclado de volta ao registo quando um patch estiver disponível.
$ENV:ActivateWorkaround = "Yes"
if($ENV:ActivateWorkaround -eq "Yes") {
New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
Set-Item -Path "HKCR:\ms-msdt" -Value "URL:ms-msdt_bak"
Rename-Item -Path "HKCR:\ms-msdt" -newName "ms-msdt_bak"
} else {
New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
Rename-Item -Path "HKCR:\ms-msdt_bak" -newName "ms-msdt"
Set-Item -Path "HKCR:\ms-msdt" -Value "URL:ms-msdt"
}