Coverage › CVE-2022-30190

CVE-2022-30190 Mapped Sigma

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Vendor / product

Microsoft — Windows

Description (CISA)

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.

Added to KEV

2022-06-14

Due date

2022-07-05

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-610

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2022-30190

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1105 Ingress Tool Transfer primary impact

• DET0060 Detect Ingress Tool Transfers via Behavioral Chain
  AN0165 Windows

  Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: ParentProcessName DestinationIPCategory FilePathRegex
  AN0166 Linux

  Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

  auditd:SYSCALL connect, execve, write → DC0064 Command Execution

  auditd:SYSCALL file creation/modification → DC0039 File Creation

  iptables:LOG TCP connections → DC0078 Network Traffic Flow

  Tunable: ToolName DownloadExtension
  AN0167 macOS

  Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation

  macos:unifiedlog file write/create → DC0039 File Creation

  macos:unifiedlog connection open → DC0082 Network Connection Creation

  Tunable: DirectoryTargeted ProcessPath
  AN0168 ESXi

  Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

  esxi:hostd command execution → DC0064 Command Execution

  esxi:vmkernel file write → DC0039 File Creation

  Tunable: ToolName DatastorePath
  AN0169 Network Devices

  Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

  NSM:Flow connection metadata → DC0078 Network Traffic Flow

  snmp:syslog firmware write/log event → DC0039 File Creation

  Tunable: PayloadVolumeThreshold ProtocolUsed

Sigma rules tagged attack.t1105 (87)

All 87 rules on the technique page →

T1204.002 Malicious File exploitation technique

• DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
  AN0819 Windows

  User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

  Tunable: TimeWindow SuspiciousExtensions UserPaths ParentApps SignerAllowList
  AN0820 macOS

  User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

  macos:unifiedlog process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions → DC0039 File Creation

  Tunable: TimeWindow QuarantineRequired ParentApps
  AN0821 Linux

  User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.

  auditd:SYSCALL open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions → DC0039 File Creation

  auditd:SYSCALL execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser → DC0032 Process Creation

  Tunable: TimeWindow DesktopParentMap

Sigma rules tagged attack.t1204.002 (39)

All 39 rules on the technique page →

Sigma rules tagged with this CVE directly

2 rules carry cve.2022-30190.