# Microsoft August 2022 patch includes actively exploited flaw

Published: 2022-08-09 · Severity: elevated
Canonical: https://vorant.io/reports/e8483f2d-1427-5251-9e76-759718057fa7/microsoft-august-2022-patch-includes-actively-exploited-flaw

> Microsoft releases patches for multiple vulnerabilities including CVE-2022-34713, confirmed exploited in the wild.

On August 10, 2022, Microsoft published security updates addressing multiple vulnerabilities across its product line. The vulnerabilities pose risks including application crashes and potential remote code execution allowing attackers to gain control of affected systems. Among these, CVE-2022-34713 has been confirmed by Microsoft as actively exploited in the wild, warranting urgent patching. Microsoft recommends immediate application of available security patches via Windows Update to mitigate risk of further exploitation and potential widespread compromise.

## Mentioned in this report

- Vulnerabilities: CVE-2022-34713 (KEV)

## Detection guidance (public sample)

### MSDT Launched to Open a Diagcab Troubleshooting Package

ATT&CK: T1203

msdt.exe invoked with a .diagcab package, the user-interaction trigger for DogWalk (CVE-2022-34713) path-traversal exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MSDT Launched to Open a Diagcab Troubleshooting Package
id: c13f2210-2846-53e1-bc94-eb10729f650c
status: experimental
description: Detects msdt.exe launched with a .diagcab package on the command line.
  Malicious diagcab files downloaded from the web or email were used to exploit CVE-2022-34713
  (DogWalk). Generalises on the msdt + diagcab pattern, not on a specific file name.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \msdt.exe
    CommandLine|contains: .diagcab
  condition: selection
falsepositives:
- IT staff or support tooling that distributes legitimate custom diagnostic packages
  (.diagcab)
- Administrators testing Windows troubleshooting packs
level: medium
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2022/20220810-ms.html
```

### MSDT or Sdiagnhost Dropping Files into a Startup Folder

ATT&CK: T1203

msdt.exe or sdiagnhost.exe writing a file to a Startup folder, matching the DogWalk (CVE-2022-34713) payload-drop behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MSDT or Sdiagnhost Dropping Files into a Startup Folder
id: 613af7df-cf8f-50fe-9216-801635e544f9
status: experimental
description: Detects msdt.exe or sdiagnhost.exe creating files in a Start Menu Startup
  folder. DogWalk (CVE-2022-34713) abuses path traversal in a diagcab to plant an
  executable in Startup for execution at next logon.
tags:
- attack.execution
- attack.t1203
- attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \msdt.exe
    - \sdiagnhost.exe
    TargetFilename|contains: \Start Menu\Programs\Startup\
  condition: selection
falsepositives:
- Very rare custom diagnostic packages that deliberately create Startup shortcuts
level: high
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2022/20220810-ms.html
```

### Office or Browser Application Spawning MSDT

ATT&CK: T1203

Office apps, browsers or mail clients spawning msdt.exe, a pattern seen in client-side exploitation of the Microsoft Support Diagnostic Tool. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office or Browser Application Spawning MSDT
id: ec750e97-24b0-5ebf-a10b-e67fff31f013
status: experimental
description: Detects Office, mail client or browser processes spawning msdt.exe. Client-side
  exploitation of MSDT flaws typically begins from a document, email or downloaded
  file opened by the user.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    - \msedge.exe
    - \chrome.exe
    - \firefox.exe
    Image|endswith: \msdt.exe
  condition: selection
falsepositives:
- Users launching a Windows troubleshooter from the Office or browser Help menu
- Browser-launched support links for legitimate Microsoft diagnostics
level: medium
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2022/20220810-ms.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20220810-ms.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e8483f2d-1427-5251-9e76-759718057fa7/microsoft-august-2022-patch-includes-actively-exploited-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup