Skip to content
yararules.org
Menu

YARA rules tagged CVE_2022_30190

7 rules carry the tag “CVE_2022_30190”.

  • SIGNATURE_BASE_EXPL_Follina_CVE_2022_30190_Msdt_Msprotocoluri_May22

    Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation

    ExploitSignature Base (Florian Roth / Nextron)· Tobias Michalski, Christian Burkard· 2022-05-30
  • SIGNATURE_BASE_SUSP_LNK_Follina_Jun22

    Detects LNK files with suspicious Follina/CVE-2022-30190 strings

    Suspicious / huntingSignature Base (Florian Roth / Nextron)· Paul Hager· 2022-06-02
  • SIGNATURE_BASE_SUSP_Msdt_Artefact_Jun22_2

    Detects suspicious pattern in msdt diagnostics log (e.g. CVE-2022-30190 / Follina exploitation)

    Suspicious / huntingSignature Base (Florian Roth / Nextron)· Christian Burkard· 2022-06-01
  • SIGNATURE_BASE_SUSP_DOC_RTF_Externalresource_EMAIL_Jun22

    Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment

    Suspicious / huntingSignature Base (Florian Roth / Nextron)· Christian Burkard· 2022-06-01
  • SIGNATURE_BASE_SUSP_Doc_RTF_Externalresource_May22

    Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation

    Suspicious / huntingSignature Base (Florian Roth / Nextron)· Tobias Michalski, Christian Burkard· 2022-05-30
  • SIGNATURE_BASE_SUSP_Doc_Wordxmlrels_May22

    Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation

    Suspicious / huntingSignature Base (Florian Roth / Nextron)· Tobias Michalski, Christian Burkard, Wojciech Cieslak· 2022-05-30
  • SIGNATURE_BASE_SUSP_PS1_Msdt_Execution_May22

    Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation

    Suspicious / huntingSignature Base (Florian Roth / Nextron)· Nasreddine Bencherchali, Christian Burkard· 2022-05-31