CVE-2022-30190 - Microsoft Support Diagnostic Tool Vulnerability

[NiekMeulendijks]

Does Cortex XDR Prevent protect against CVE-2022-30190 (Microsoft Support Diagnostic Tool Vulnerability)?

Thank you!

[RonaldWeiss]

Hello,

hope it's ok to attach mine, as it is the same issue/idea...

If this would work, your issue would be resolved as well:

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-does-not-block-windows-binaries/t...

[MartinPfeil]

I haven't seen anything from Palo Alto yet.

We are using the following XQL query to detect attacks, obviously it is a little bit rough and any improvement is welcome

dataset = xdr_data
| filter action_process_image_name contains "msdt.exe"
| filter action_process_image_command_line contains "PCWDiagnostic" and action_process_image_command_line contains "IT_RebrowseForFile"
| fields _time, agent_hostname as host, actor_effective_username as user, actor_process_image_path as parent_process, action_process_image_path as executed , action_process_image_command_line as command_line

[RonaldWeiss]

@MartinPfeil : good idea, well done query. but you cannot prevent with it. 
That's the reason i'd love to see a hashblock for msdt.exe...

[SHoehne]

The problem could then be, that there could be different versions with different hashes...

I just disabled the Diagnostics using a group policy which seems a better approach for me.