Huntress Analyzes Follina MSDT Exploit in Microsoft Office Documents
Summary
Huntress analyzed how malicious Office documents could invoke MSDT to execute code, including through RTF preview. The article details the exploit, detection and mitigations, and reports that a Microsoft patch was later validated for Windows 10 and 11.
Key points
- Huntress reproduced the Follina technique, later identified as CVE-2022-30190, using a Microsoft Word document that invoked MSDT through an external HTML reference.
- The examined payload used PowerShell commands to retrieve and decode a CAB file, then run an executable; the executable’s impact was unknown.
- Huntress found that the exploit required HTML padding and documented a shortened trigger. RTF files could also invoke it through Windows Explorer’s Preview Pane.
- The technique could execute code as the user opening or previewing the document; remote payload access could also expose NTLM hashes, according to the article.
- Huntress described detecting suspicious child processes of msdt.exe and sdiagnhost.exe, and said it was monitoring for exploit variations.
- Suggested mitigations included enabling the Office child-process Attack Surface Reduction rule or removing the ms-msdt file association.
- An update said Microsoft had released a patch and Huntress had tested and verified its effectiveness on Windows 10 and Windows 11.
Article Details
- Attack Vectors
- A Microsoft Word document references attacker-hosted HTML that invokes the ms-msdt protocol and triggers the MSDT vulnerability.
- The exploit can execute when a user opens a malicious document; an RTF file may also trigger it in Windows Explorer's Preview Pane.
- The exploit embeds PowerShell expressions in MSDT parameters and uses cmd.exe to decode and execute a payload.
- A remote-triggered connection may expose the victim's NTLM hash.
- Defensive Notes
- Apply Microsoft's patch for CVE-2022-30190; Huntress reported verifying the patch on Windows 10 and Windows 11.
- Enable the Microsoft Defender Attack Surface Reduction rule “Block all Office applications from creating child processes” in Block mode; consider Audit mode first to check for adverse effects.
- Removing the ms-msdt file-type association was described as a mitigation; back up registry settings before making changes.
- Educate users to treat unexpected document attachments cautiously, including because an RTF file may trigger through Preview Pane.
- Huntress identified child processes of msdt.exe, including sdiagnhost.exe and conhost.exe, as potential detection clues.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//www[.]xmlformats[.]com/office/word/2022/wordprocessingDrawing/RDF842l.html | External HTML resource referenced by the exploit document; the article reports the site was no longer online at the time of analysis. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe sample conceals its command sequence as Base64 data nested within PowerShell expressions.T1059.001 · PowerShellPowerShell expressions embedded in the MSDT parameters are evaluated through Invoke-Expression.T1059.003 · Windows Command ShellThe decoded commands launch cmd.exe to kill msdt.exe, locate and decode a CAB file, and execute rgb.exe.T1140 · Deobfuscate/Decode Files or InformationThe command uses certutil to decode Base64 content into a CAB file before expanding it.T1187 · Forced AuthenticationThe article says a remote-triggered connection can transmit the victim's NTLM hash to an adversary.T1203 · Exploitation for Client ExecutionThe document exploits the MSDT vulnerability to execute code on the victim's system.T1204.002 · Malicious FileExecution can follow opening the malicious Word document; an RTF file may also trigger through Windows Explorer's Preview Pane.
CVE
People
Bill DemirkapiHis research on a hardcoded HTML-processing buffer size helped explain the exploit's padding requirement.John HammondHuntress author who presented the exploit analysis.Kevin BeaumontHis blog and analysis were listed as further reading.Matthew BrennanHuntress Detection Engineer credited for the Sigma detection rules.Rich WarrenShared research that helped Huntress investigate the exploit's padding requirement.
Vendors
Products
Microsoft Defender Antimalware PlatformIf utilizing Microsoft Defender’s Attack Surface Reduction (ASR) rules in your environment, activating the rule “Block all Office applications from creating child processes” in Block mode will prevent this from beingMicrosoft OfficeHomeBlogRapid Response: Microsoft Office RCE - “Follina” MSDT AttackMicrosoft Wordtechnique used through MSDT (Microsoft Diagnostics Tool) and Microsoft Office utilities, namely Microsoft Word. Throughout the next coming days, we expect exploitation attempts in the wild through email-basedMSDTHomeBlogRapid Response: Microsoft Office RCE - “Follina” MSDT AttackWindows Defenderthat the specific exploits seen in the wild trigger Huntress Managed Antivirus incidents with Windows Defender. In addition, our Threat Operations team is hunting across our Process Insights technology for new