VORANT. Threat Intelligence Research Sign in Create a free account

Microsoft August 2022 patch includes actively exploited flaw

elevated vulnerability

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Microsoft releases patches for multiple vulnerabilities including CVE-2022-34713, confirmed exploited in the wild.

On August 10, 2022, Microsoft published security updates addressing multiple vulnerabilities across its product line. The vulnerabilities pose risks including application crashes and potential remote code execution allowing attackers to gain control of affected systems. Among these, CVE-2022-34713 has been confirmed by Microsoft as actively exploited in the wild, warranting urgent patching. Microsoft recommends immediate application of available security patches via Windows Update to mitigate risk of further exploitation and potential widespread compromise.

Mentioned in this report

Vulnerabilities CVE-2022-34713KEV

Related reporting

Detection guidance

MSDT Launched to Open a Diagcab Troubleshooting Package

ATT&CK T1203

msdt.exe invoked with a .diagcab package, the user-interaction trigger for DogWalk (CVE-2022-34713) path-traversal exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: MSDT Launched to Open a Diagcab Troubleshooting Package
id: c13f2210-2846-53e1-bc94-eb10729f650c
status: experimental
description: Detects msdt.exe launched with a .diagcab package on the command line.
  Malicious diagcab files downloaded from the web or email were used to exploit CVE-2022-34713
  (DogWalk). Generalises on the msdt + diagcab pattern, not on a specific file name.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \msdt.exe
    CommandLine|contains: .diagcab
  condition: selection
falsepositives:
- IT staff or support tooling that distributes legitimate custom diagnostic packages
  (.diagcab)
- Administrators testing Windows troubleshooting packs
level: medium
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2022/20220810-ms.html

MSDT or Sdiagnhost Dropping Files into a Startup Folder

ATT&CK T1203

msdt.exe or sdiagnhost.exe writing a file to a Startup folder, matching the DogWalk (CVE-2022-34713) payload-drop behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: MSDT or Sdiagnhost Dropping Files into a Startup Folder
id: 613af7df-cf8f-50fe-9216-801635e544f9
status: experimental
description: Detects msdt.exe or sdiagnhost.exe creating files in a Start Menu Startup
  folder. DogWalk (CVE-2022-34713) abuses path traversal in a diagcab to plant an
  executable in Startup for execution at next logon.
tags:
- attack.execution
- attack.t1203
- attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \msdt.exe
    - \sdiagnhost.exe
    TargetFilename|contains: \Start Menu\Programs\Startup\
  condition: selection
falsepositives:
- Very rare custom diagnostic packages that deliberately create Startup shortcuts
level: high
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2022/20220810-ms.html

Office or Browser Application Spawning MSDT

ATT&CK T1203

Office apps, browsers or mail clients spawning msdt.exe, a pattern seen in client-side exploitation of the Microsoft Support Diagnostic Tool. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Office or Browser Application Spawning MSDT
id: ec750e97-24b0-5ebf-a10b-e67fff31f013
status: experimental
description: Detects Office, mail client or browser processes spawning msdt.exe. Client-side
  exploitation of MSDT flaws typically begins from a document, email or downloaded
  file opened by the user.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    - \msedge.exe
    - \chrome.exe
    - \firefox.exe
    Image|endswith: \msdt.exe
  condition: selection
falsepositives:
- Users launching a Windows troubleshooter from the Office or browser Help menu
- Browser-launched support links for legitimate Microsoft diagnostics
level: medium
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2022/20220810-ms.html

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20220810-ms.html

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs