Exploit for CVE-2022-30190

## https://sploitus.com/exploit?id=3B5FAE98-6B11-5401-B4D8-4B397BCEE367
# Follina — CVE-2022-30190 Threat Analysis

> Microsoft MSDT Remote Code Execution zero-day — active exploitation investigation by **MUHAMMAD ZAWAR KHATTAK**

🔗 **[View Full Writeup →](https://zavikhttak.github.io/Follina-CVE-2022-30190-Analysis)**

---

## 🧪 Scenario

On a Friday evening, the team was alerted with a new RCE vulnerability actively being exploited in the wild. I was tasked with analyzing and researching the malicious sample to collect intelligence for the weekend team.

---

## 🧰 Tools Used

| Tool | Purpose |
|------|---------|
| VirusTotal | Static analysis, file hashes, contacted URLs |
| Any.Run | Dynamic sandbox, MITRE ATT&CK mapping |
| CVE.org | Official vulnerability research |
| OSINT / GitHub | Detection rules, threat intelligence |
| Linux CLI | File hashing via sha1sum |

---

## 🔍 Key Findings

| # | Finding |
|---|---------|
| SHA1 Hash | `06727ffda60359236a8029e0b3e8a0fd11c23313` |
| File Type | Office Open XML Document (disguised as .doc) |
| Malicious URL | Embedded in `word/_rels/document.xml.rels` |
| Process Killed | `msdt.exe` — Microsoft Support Diagnostic Tool |
| MITRE Technique | T1059 — Command and Scripting Interpreter |
| CVE | CVE-2022-30190 — Microsoft MSDT RCE |

---

## 🛡️ Detection Rule (Windows Event ID 4688)

```
ProcessName:       msdt.exe
ParentProcessName: WINWORD.EXE
EventID:           4688
```

---

## 📚 References

- [CVE-2022-30190 — cve.org](https://vulners.com/cve/CVE-2022-30190)
- [MITRE ATT&CK T1059](https://attack.mitre.org/techniques/T1059/)
- [Detection Rules — GitHub](https://github.com/archanchoudhury/MSDT-CVE-2022-30190)

---

`#BlueTeam` `#ThreatIntel` `#Follina` `#CVE-2022-30190` `#MITRE` `#SOC` `#MalwareAnalysis` `#CyberSecurity`