Microsoft · Windows
A flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) component of Windows lets an attacker abuse the way MSDT is invoked via its URL protocol from a calling application such as Word, which is externally controllable. Exploitation requires a local attacker (per the attack vector) and user interaction, and the attacker can then run arbitrary code with the privileges of the calling application, enabling them to install programs, view, change, or delete data, or create new accounts within the user's rights.
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
First seen exploited 2 days before it was disclosed. Public exploit code (Metasploit) was available 3 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
This vulnerability is exploit through a maliciously crafted Word document, which downloads html that then runs commands on the target machine and has been seen to download additional payloads on target machines.
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2022-30190 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
LLM-assisted vulnerability research: Interacting with LLMs to better understand publicly reported vulnerabilities, such as the CVE-2022-30190 Microsoft Support Diagnostic Tool (MSDT) vulnerability (known as “Follina”).
The threat actor is using a Microsoft Office document (Памятка.docx) that has weaponized with the Follina (CVE-2022-30190) vulnerability to drop Woody Rat.
DEV-0464 also rapidly adopted the Microsoft Support Diagnostic Tool (MSDT) vulnerability (CVE-2022-30190) in their campaigns.
Variant #1 A107-004 Protected Theater - APT44, COLIBRI, Execution, Variant #2 A106-107 Protected Theater - APT44, Create GOGETTER Scheduled Task A107-005 Protected Theater - APT44, DARKCRYSTALRAT, Execution, Variant #1 A105-346 Protected Theater - APT44, EARLYBLOOM, CVE-2022-30190, HTML Downloader,…
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.