CVE-2022-30190

What it actually does

This vulnerability, widely known as Follina, allows remote code execution through the Microsoft Support Diagnostic Tool URL protocol handler when it is invoked by an application such as Microsoft Word. A malicious Office document, RTF file, or document that loads attacker-controlled remote content can trigger the ms-msdt protocol and cause msdt.exe to execute attacker-supplied commands with the privileges of the user who opened or previewed the file. Because exploitation does not require administrative privileges and can lead to code execution through trusted Windows components, attackers can use it to run PowerShell, download payloads, establish persistence, steal data, or move laterally depending on the user’s rights.

Why it matters to the business

Successful exploitation can give an attacker control over a user workstation or server session, enabling malware installation, credential theft, data access, ransomware deployment, and business disruption. The vulnerability is in the CISA Known Exploited Vulnerabilities catalog, has been used in ransomware activity, and has a very high EPSS score, so unpatched Windows systems should be treated as high-priority exposure even though the issue is older. Organizations with broad use of Microsoft Office and Windows endpoints face elevated risk because exploitation can begin from routine user actions such as opening or previewing a document.

How an attack unfolds

An attacker typically crafts a malicious Office or RTF document that references attacker-controlled HTML or embeds a payload designed to invoke the ms-msdt URL protocol. The document is delivered through phishing, a compromised website, file share, or other document-delivery channel. When a user opens or previews the file, the calling application invokes msdt.exe through the ms-msdt handler. The malicious command parameters cause MSDT to execute script or shell commands, commonly PowerShell, under the current user context. The attacker then downloads additional tooling, establishes command-and-control, steals credentials or files, and may deploy ransomware or use the compromised system as a foothold for lateral movement.

How to fix it

Apply the Microsoft security updates released for CVE-2022-30190 across all affected Windows client and server versions, including Windows 7/8.1/10/11 and Windows Server 2008/2012/2016/2019/2022 where applicable. If immediate patching is not possible, disable the MSDT URL protocol handler by backing up and removing the ms-msdt registry association, and restrict or monitor execution of msdt.exe. Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from creating executable content. Harden Office by disabling macros from the internet, enforcing Protected View, blocking untrusted remote template retrieval where feasible, and filtering inbound Office/RTF attachments from untrusted sources. Because this issue is in the KEV catalog and associated with ransomware activity, treat any remaining unpatched systems as urgent remediation targets.

How to confirm the fix worked

Confirm that each affected Windows system has the relevant Microsoft cumulative or security update installed. Validate that the ms-msdt protocol handler is removed or disabled where the workaround is used by checking for the presence of the HKEY_CLASSES_ROOT\ms-msdt registry key. Test endpoint controls by confirming that Office applications cannot spawn msdt.exe, PowerShell, cmd.exe, mshta.exe, wscript.exe, or cscript.exe from untrusted documents. Review vulnerability scanner results for affected Windows versions and confirm they no longer report exposure. Where feasible, perform controlled testing with benign detection content to verify that process creation logging, EDR alerts, and SIEM rules trigger on Office-to-MSDT or MSDT-to-script-interpreter process chains.

Typical attack path

1. Attacker prepares a malicious Office, RTF, or document lure that invokes the ms-msdt protocol.
2. Attacker hosts supporting HTML or payload content on an external server or embeds the trigger in the document workflow.
3. Victim receives the file through phishing, web download, messaging, or a shared location.
4. Victim opens or previews the document in a vulnerable Windows/Office configuration.
5. The calling application launches msdt.exe using crafted ms-msdt parameters.
6. MSDT executes attacker-controlled commands with the privileges of the current user.
7. Attacker runs PowerShell, cmd, mshta, wscript, or similar tools to download and execute second-stage payloads.
8. Attacker establishes persistence, collects credentials or data, performs discovery, and may move laterally or deploy ransomware.

How to detect it

Hunt endpoint and SIEM telemetry for process creation events where Microsoft Office applications, Explorer preview handlers, browsers, email clients, or archive tools launch msdt.exe. Pay particular attention to command lines containing ms-msdt:, PCWDiagnostic, IT_RebrowseForFile, IT_BrowseForFile, or encoded PowerShell. Review child processes of msdt.exe and sdiagnhost.exe for script interpreters, LOLBins, or download utilities such as powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, certutil.exe, curl.exe, or bitsadmin.exe. Correlate suspicious process chains with file-open events for Office, RTF, or downloaded documents and with network connections to recently registered domains, unknown IP addresses, or attacker-controlled web servers. Useful log sources include EDR process telemetry, Windows Security Event ID 4688, Sysmon Event IDs 1, 3, 7, 11, and 22, Microsoft Defender alerts, PowerShell Script Block Logging Event ID 4104, Office security telemetry, email gateway logs, web proxy logs, and DNS logs. For confirmed or suspected exploitation, collect the original document, downloaded remote template or HTML, msdt.exe command line, spawned script content, network destinations, persistence artifacts, and any payloads written shortly after the document was opened.

• ms-msdt:
• msdt.exe
• sdiagnhost.exe
• PCWDiagnostic
• IT_RebrowseForFile
• IT_BrowseForFile
• Invoke-Expression
• IEX
• FromBase64String
• powershell.exe -EncodedCommand
• WINWORD.EXE
• EXCEL.EXE
• POWERPNT.EXE
• OUTLOOK.EXE
• Image=msdt.exe ParentImage=*\WINWORD.EXE
• Image=msdt.exe ParentImage=*\EXCEL.EXE
• Image=msdt.exe ParentImage=*\POWERPNT.EXE
• Image=msdt.exe ParentImage=*\OUTLOOK.EXE
• ParentImage=*\msdt.exe Image=*\powershell.exe
• ParentImage=*\msdt.exe Image=*\cmd.exe
• ParentImage=*\msdt.exe Image=*\mshta.exe
• ParentImage=*\msdt.exe Image=*\wscript.exe
• ParentImage=*\msdt.exe Image=*\cscript.exe
• ParentImage=*\sdiagnhost.exe Image=*\powershell.exe
• HKEY_CLASSES_ROOT\ms-msdt
• /id PCWDiagnostic
• /skip force
• msdt.exe /id PCWDiagnostic

What your security team should do

• Immediately identify and patch all affected Windows client and server systems, prioritizing internet-facing systems, user workstations, VDI images, and systems used by privileged users.
• Treat this as a high-urgency vulnerability because it is in the CISA KEV catalog, has observed exploitation, has been associated with ransomware activity, and has a very high EPSS score.
• If patching cannot be completed quickly, disable the ms-msdt URL protocol handler and deploy compensating controls that prevent Office applications from spawning child processes.
• Create or enable detections for Office applications launching msdt.exe and for msdt.exe spawning PowerShell, cmd.exe, mshta.exe, wscript.exe, cscript.exe, rundll32.exe, or regsvr32.exe.
• Hunt historical endpoint telemetry for suspicious msdt.exe execution, especially around document-open events, phishing reports, and downloads from email or web browsers.
• Block or detonate suspicious Office and RTF attachments at email and web gateways, especially documents that retrieve remote templates or contain references to ms-msdt.
• Review compromised-host playbooks for credential theft and ransomware follow-on activity if exploitation indicators are found.
• Ensure endpoint logging captures process command lines, parent-child process relationships, network connections, and script block logging for PowerShell.