huntrule

Windows Registry Set of ms-msdt MSProtocol URI (CVE-2022-30190)

Alerts on Windows registry writes under HKCR\ms-msdt\ that may indicate MSDT protocol abuse.

FreeReviewedSigma · Medium · v5
Product
windows
Category
registry_set
Author
Sittikorn S (SigmaHQ), DRL 1.1
Published
2020-05-31
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags registry value writes under HKCR\ms-msdt\ that set up the MSProtocol URI scheme. Attackers may use this scheme handler registration to trigger unwanted behavior tied to CVE-2022-30190-style exploitation attempts. The detection relies on Windows registry set telemetry that captures the TargetObject path beginning with HKCR\ms-msdt\.

Reporting behind it

Related detections4 linkedT1221 — drag to rearrange
Suspicious search-ms URI Handler Invocation in CVE-2023-36584 Exploit Chain
Suspicious Office Application Spawning Script Interpreter (via process_creation)
Malicious Equation Editor Child Process Execution via process_creation
Web Server GET Requests Containing SSTI Payload Strings (Server-Side Template Injection)
Windows Registry Set of ms-msdt MSProtocol URI (CVE-2022-30190)
Pivot detection · T1221 · 4 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.