CVE-2022-30190 - Microsoft Support Diagnostic Tool Vulnerability

Showing results for 
Show  only  | Search instead for 
Did you mean: 

CVE-2022-30190 - Microsoft Support Diagnostic Tool Vulnerability

L0 Member

Does Cortex XDR Prevent protect against CVE-2022-30190 (Microsoft Support Diagnostic Tool Vulnerability)?

Thank you!


L2 Linker


hope it's ok to attach mine, as it is the same issue/idea...

If this would work, your issue would be resolved as well:

L1 Bithead

I haven't seen anything from Palo Alto yet.

We are using the following XQL query to detect attacks, obviously it is a little bit rough and any improvement is welcome


dataset = xdr_data
| filter action_process_image_name contains "msdt.exe"
| filter action_process_image_command_line contains "PCWDiagnostic" and action_process_image_command_line contains "IT_RebrowseForFile"
| fields _time, agent_hostname as host, actor_effective_username as user, actor_process_image_path as parent_process, action_process_image_path as executed , action_process_image_command_line as command_line

L2 Linker

@MartinPfeil : good idea, well done query. but you cannot prevent with it. 
That's the reason i'd love to see a hashblock for msdt.exe...

The problem could then be, that there could be different versions with different hashes...

I just disabled the Diagnostics using a group policy which seems a better approach for me.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!