VORANT. Threat Intelligence Research Sign in Create a free account

Microsoft June 2022 patches address actively exploited flaw

high vulnerability technologygovernment-nationaleducationhealthcarefinancial-servicesmanufacturingretaildefense

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Microsoft patches June 2022 vulnerabilities; CVE-2022-30190 actively exploited in the wild.

On June 15, 2022, Microsoft released patches for multiple vulnerabilities across its product portfolio. Among these, CVE-2022-30190 has been confirmed by Microsoft as actively exploited in the wild, presenting an immediate risk of widespread compromise. The vulnerability allows attackers to achieve remote code execution and gain control of affected systems. IPA (Information-technology Promotion Agency, Japan) urges organizations to apply patches immediately given the confirmed exploitation activity. Defenders should prioritize patching CVE-2022-30190 and other vulnerabilities in this monthly release to prevent application crashes, system compromise, and data theft. The advisory does not specify which products are affected by individual CVEs, but this is a standard Microsoft Patch Tuesday bulletin requiring comprehensive remediation across Windows and related software.

Mentioned in this report

Vulnerabilities CVE-2022-30190KEV

Related reporting

Detection guidance

Office Application Spawning msdt.exe (Follina CVE-2022-30190)

ATT&CK T1203

Microsoft Office or related client applications launching the Support Diagnostic Tool msdt.exe, the exploitation primitive for CVE-2022-30190 via ms-msdt URI in documents. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Office Application Spawning msdt.exe (Follina CVE-2022-30190)
description: Detects Office and related client applications spawning msdt.exe, which
  is how a malicious document abuses the ms-msdt URI handler to exploit CVE-2022-30190.
  Office launching the diagnostic tool is very rare in normal use.
tags:
- attack.execution
- attack.t1203
- attack.initial-access
- attack.t1566.001
- cve.2022-30190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    - \MSACCESS.EXE
    - \MSPUB.EXE
    - \VISIO.EXE
    - \ONENOTE.EXE
    - \AcroRd32.exe
    - \Acrobat.exe
    Image|endswith: \msdt.exe
  condition: selection
falsepositives:
- Rare user-initiated troubleshooting launched from an Office help dialog
level: high
id: 6162d22d-8ef5-57f7-a392-0e98dfbad144
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2022/20220615-ms.html

msdt.exe Launched with PCWDiagnostic and Injection-Style Arguments

ATT&CK T1203

msdt.exe invoked with the PCWDiagnostic id and IT_BrowseForFile or $() / Invoke-Expression style arguments, characteristic of CVE-2022-30190 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: msdt.exe Launched with PCWDiagnostic and Injection-Style Arguments
description: Detects msdt.exe command lines using the PCWDiagnostic answer-file pattern
  together with IT_BrowseForFile/IT_RebrowseForFile parameters or embedded PowerShell
  expression syntax, as seen in CVE-2022-30190 (Follina) exploitation. Generalises
  on the argument pattern, not on any specific payload.
tags:
- attack.execution
- attack.t1203
- cve.2022-30190
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \msdt.exe
  selection_args_a:
    CommandLine|contains: PCWDiagnostic
  selection_args_b:
    CommandLine|contains:
    - IT_BrowseForFile
    - IT_RebrowseForFile
    - $(
    - Invoke-Expression
    - IEX(
  condition: selection_img and selection_args_a and selection_args_b
falsepositives:
- Support staff running scripted msdt diagnostics with custom answer parameters
level: high
id: b584a4e6-a6db-5de6-b6cb-a6669bc415be
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2022/20220615-ms.html

Suspicious Child Process of sdiagnhost.exe

ATT&CK T1203

sdiagnhost.exe (the diagnostic host used by msdt.exe) spawning shells or script/LOLBin interpreters, indicating post-exploitation of CVE-2022-30190. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process of sdiagnhost.exe
description: Detects the Scripted Diagnostics Native Host spawning command interpreters
  or common LOLBins. After CVE-2022-30190 exploitation via msdt.exe, the injected
  payload runs under sdiagnhost.exe.
tags:
- attack.execution
- attack.t1203
- cve.2022-30190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \sdiagnhost.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Built-in Windows troubleshooters that run PowerShell diagnostic scripts through
  sdiagnhost
level: medium
id: 877881d2-e05d-50c9-a9f3-6ca8fe8b67c9
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2022/20220615-ms.html

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20220615-ms.html

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs