huntrule

Windows Registry: Suspicious HKCR ms-msdt SetValue for MSDT Protocol

Alerts on Windows registry writes under HKCR\ms-msdt\ that may indicate MSDT protocol abuse.

FreeUnreviewedSigmamediumv1
title: "Windows Registry: Suspicious HKCR ms-msdt SetValue for MSDT Protocol"
id: 5094eb0b-2a40-4620-8f2d-3d1c4939aae6
status: test
description: This rule flags Windows registry SetValue activity targeting keys under HKCR\ms-msdt\, where an ms-msdt MSProtocol URI scheme handler may be configured. Such protocol handler modifications can be used by attackers to redirect execution or trigger unintended MSDT-related behavior. Detection relies on telemetry that records registry value set operations and the TargetObject path prefix matching HKCR\ms-msdt\.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
  - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-30190/registry_set_exploit_cve_2022_30190_msdt_follina.yml
author: Sittikorn S, Huntrule Team
date: 2020-05-31
modified: 2023-08-17
tags:
  - attack.stealth
  - attack.t1221
  - detection.emerging-threats
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|startswith: HKCR\ms-msdt\
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2d9403d5-7927-46b7-8216-37ab7c9ec5e3
    type: derived

What it detects

This rule flags Windows registry SetValue activity targeting keys under HKCR\ms-msdt\, where an ms-msdt MSProtocol URI scheme handler may be configured. Such protocol handler modifications can be used by attackers to redirect execution or trigger unintended MSDT-related behavior. Detection relies on telemetry that records registry value set operations and the TargetObject path prefix matching HKCR\ms-msdt\.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.