CVE-2022-30190 - Microsoft Support Diagnostic Tool Vulnerability

[NiekMeulendijks]

Does Cortex XDR Prevent protect against CVE-2022-30190 (Microsoft Support Diagnostic Tool Vulnerability)?

Thank you!

[Luc_Desaulniers]

Great start on the query. Here's another way you could do this to avoid an and statement:

config case_sensitive = false
|dataset = xdr_data
|filter event_type = ENUM.PROCESS
|filter action_process_image_name = "msdt.exe" and action_process_image_command_line = "*PCWDiagnostic*IT_RebrowseForFile*"
|fields agent_hostname, action_process_username as User, action_process_image_name as Child_Process, action_process_image_path as Child_Path, action_process_image_command_line as Child_CMD_Line, action_process_image_sha256 as Child_SHA256, actor_process_image_name as Parent_Process, actor_process_image_path as Parent_Path, os_actor_process_command_line as Parent_CMD_Line

[RonaldWeiss]

Hi @Luc_Desaulniers ,

thanks for the hint with the custom prevention rules. i really didnt think of that 🙂

works like a charm!

[parreira]

https://unit42.paloaltonetworks.com/cve-2022-30190-msdt-code-execution-vulnerability/

mentions ""WildFire and Cortex XDR categorize all known samples we’ve come across as malware.""

[kcross]

Please check out our latest blog post Prevention, Hunting and Playbooks for MSDT Zero-Day (CVE-2022-30190).