CVE-2022-30190 Detection Scenario by crowdsecurity | CrowdSec Hub

CVE-2022-30190

Attack scenariowindows:rceMITRE T1059MITRE T1203cve.CVE-2022-30190

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/windows-CVE-2022-30190-msdt

Detect CVE-2022-30190 from sysmon events

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/windows-cve

Installs 2 parsers and 2 scenarios.

View Windows - CVE Detection →

Installation

sudo cscli scenarios install crowdsecurity/windows-CVE-2022-30190-msdt

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/windows-CVE-2022-30190-msdt.yaml· 23 linesGitHub

1type: trigger1
2name: crowdsecurity/CVE-2022-30190-msdt
3description: "Detect CVE-2022-30190 from sysmon events"
4filter: |2
5  evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1' && 
6  Upper(evt.Parsed.Image) endsWith 'MSDT.EXE' && 
7  Upper(evt.Parsed.ParentImage) endsWith 'WINWORD.EXE' &&
8  (Upper(evt.Parsed.CommandLine) contains 'PCWDIAGNOSTIC' && Upper(evt.Parsed.CommandLine) contains 'IT_REBROWSEFORFILE' && Upper(evt.Parsed.CommandLine) contains 'IT_BROWSEFORFILE')
9labels:
10  type: rce
11  notification: true
12  confidence: 3
13  spoofable: 0
14  classification:3
15    - attack.T1059
16    - attack.T1203
17    - cve.CVE-2022-30190
18  behavior: "windows:rce"
19  label: "CVE-2022-30190"
20  service: windows
21scope:
22  type: user_account
23  expression: evt.Parsed.User

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

This scenario detects some attempts at exploiting CVE-2022-30190 on Windows.

It does so by parsing sysmon logs, more specifically the one with event ID 1 (process creation).

This means that you need a working sysmon installation to be able to use this scenario.