Detection rules › Splunk
CVE-2022-30190: Microsoft Office Code Execution Vulnerability (Windows Event Log)
Aka: Follina. A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1204.002 User Execution: Malicious File |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '11170.15434'
title: 'CVE-2022-30190: Microsoft Office Code Execution Vulnerability'
description: 'Aka: Follina. A remote code execution vulnerability exists when MSDT
is called using the URL protocol from a calling application such as Word. An attacker
who successfully exploits this vulnerability can run arbitrary code with the privileges
of the calling application. The attacker can then install programs, view, change,
or delete data, or create new accounts in the context allowed by the user’s rights.
- Threat Actor Association: APT28, GoldenJackal, RomCom, TA413 - Software Association:
CrescentImp, Qakbot/Qbot'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) ("msdt.exe" OR TERM(msdt)) (("PCWDiagnostic" and
("ms-msdt:-id" OR "ms-msdt:/id")) OR "invoke" OR (TERM(Microsoft) TERM(Office))
OR TERM(WINWORD.EXE) OR TERM(EXCEL.EXE) OR TERM(POWERPNT.EXE) OR TERM(MSACCESS.EXE)
OR TERM(OUTLOOK.EXE) OR TERM(VISIO.EXE) OR TERM(WINPROJ.EXE) OR TERM(wordpad.exe))
| table _time, host, user process, parent_*, process_*, signature_id | bin span=1s
| stats values(*) as * by _time, host | where (match(process, "(?i)PCWDiagnostic|invoke")
OR match(parent_process_path, "(?i)(Microsoft Office)|(WINWORD\.EXE)|(EXCEL\.EXE)|(POWERPNT\.EXE)|(MSACCESS\.EXE)|(OUTLOOK\.EXE)|(VISIO\.EXE)|(WINPROJ\.EXE)|(wordpad\.exe)"))
and match(process_name, "(?i)msdt.exe") '
techniques:
- execution:user execution:malicious file
technique_id:
- T1204.002
data_category:
- Windows event logs
references:
- https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) ("msdt.exe" OR TERM(msdt)) (("PCWDiagnostic" and ("ms-msdt:-id" OR "ms-msdt:/id")) OR "invoke" OR (TERM(Microsoft) TERM(Office)) OR TERM(WINWORD.EXE) OR TERM(EXCEL.EXE) OR TERM(POWERPNT.EXE) OR TERM(MSACCESS.EXE) OR TERM(OUTLOOK.EXE) OR TERM(VISIO.EXE) OR TERM(WINPROJ.EXE) OR TERM(wordpad.exe))
Stage 2: table
| table _time, host, user process, parent_*, process_*, signature_id
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: where
| where (match(process, "(?i)PCWDiagnostic|invoke") OR match(parent_process_path, "(?i)(Microsoft Office)|(WINWORD\.EXE)|(EXCEL\.EXE)|(POWERPNT\.EXE)|(MSACCESS\.EXE)|(OUTLOOK\.EXE)|(VISIO\.EXE)|(WINPROJ\.EXE)|(wordpad\.exe)")) and match(process_name, "(?i)msdt.exe")
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
parent_process_path | match |
|
process | match |
|
process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "msdt.exe" |
| 1 | TERM |
| 1 | msdt |
| 1 | "PCWDiagnostic" |
| 1 | "ms-msdt:-id" |
| 1 | "ms-msdt:/id" |
| 1 | "invoke" |
| 1 | TERM |
| 1 | Microsoft |
| 1 | TERM |
| 1 | Office |
| 1 | TERM |
| 1 | WINWORD.EXE |
| 1 | TERM |
| 1 | EXCEL.EXE |
| 1 | TERM |
| 1 | POWERPNT.EXE |
| 1 | TERM |
| 1 | MSACCESS.EXE |
| 1 | TERM |
| 1 | OUTLOOK.EXE |
| 1 | TERM |
| 1 | VISIO.EXE |
| 1 | TERM |
| 1 | WINPROJ.EXE |
| 1 | TERM |
| 1 | wordpad.exe |