detection.wiki

Detection rules › Sigma

Suspicious Set Value of MSDT in Registry (CVE-2022-30190)

Status
test
Severity
medium
Log source
category registry_set, product windows
Author
Sittikorn S
Source
github.com/SigmaHQ/sigma

Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.

MITRE ATT&CK coverage

TacticTechniques
Stealth

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 13: RegistryEvent (Value Set)

Rule body

title: Suspicious Set Value of MSDT in Registry (CVE-2022-30190)
id: 2d9403d5-7927-46b7-8216-37ab7c9ec5e3
status: test
description: Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
    - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
author: Sittikorn S
date: 2020-05-31
modified: 2023-08-17
tags:
    - attack.stealth
    - attack.t1221
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|startswith: 'HKCR\ms-msdt\'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetObject|startswith: 'HKCR\ms-msdt\'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
TargetObjectstarts_with
  • HKCR\ms-msdt\
field:"TargetObject" kind:starts_with value:"HKCR\ms-msdt\"