Detection rules › Splunk
Potential Follina_DogWalk Activity - mdst.exe (Sysmon)
CVE-2022-30190 (commonly referred to as Follina) and DogWalk involve a vulnerability in Microsoft Support Diagnostic Tool (msdt.exe). During exploitation, msdt.exe is observed loading the library file sdiageng.dll which can be abused by threat actors to download arbitrary code. This use case detects module loads of sdiageng.dll by msdt.exe. Sysmon event 7 is required for detection. LOLBINS\LOLBAS
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1203 Exploitation for Client Execution |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 7 | Image loaded |
Rule body yaml
id: '22480.40157'
title: Potential Follina_DogWalk Activity - mdst.exe
description: CVE-2022-30190 (commonly referred to as Follina) and DogWalk involve
a vulnerability in Microsoft Support Diagnostic Tool (msdt.exe). During exploitation,
msdt.exe is observed loading the library file sdiageng.dll which can be abused by
threat actors to download arbitrary code. This use case detects module loads of
sdiageng.dll by msdt.exe. Sysmon event 7 is required for detection. LOLBINS\LOLBAS
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=7) OR "<EventID>7<")
Image="*\\msdt.exe" ImageLoaded="*\\sdiageng.dll" | table _time, host, user host,
process, process_*, parent_process_* | bin span=1s | stats values(*) as * by _time,
host '
techniques:
- execution:exploitation for client execution
technique_id:
- T1203
data_category:
- Windows Sysmon
references:
- https://www.securonix.com/blog/detecting-microsoft-msdt-dogwalk/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=7) OR "<EventID>7<") Image="*\\msdt.exe" ImageLoaded="*\\sdiageng.dll"
Stage 2: table
| table _time, host, user host, process, process_*, parent_process_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Image | eq |
|
ImageLoaded | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>7<" |