Coverage › CVE-2022-34713
CVE-2022-34713 Mapped Sigma
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
- Vendor / product
- Microsoft — Windows
- Description (CISA)
- A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.
- Added to KEV
- 2022-08-09
- Due date
- 2022-08-30
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Unknown
- CWE
- none recorded by CISA
- CISA notes
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34713
https://nvd.nist.gov/vuln/detail/CVE-2022-34713 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1566 Phishing | exploitation technique | This vulnerability is exploited when a user is tricked by an adversary to open a maliciously crafted file either via an email or malicious website. Once the user opens the file, an adversary gains the ability to execute arbitrary code the next time the victim restarts their computer and logs in. ref 1 · ref 2 |
live |
| T1059 Command and Scripting Interpreter | secondary impact | This vulnerability is exploited when a user is tricked by an adversary to open a maliciously crafted file. Once the user opens the file, an adversary gains the ability to execute arbitrary code the next time the victim restarts their computer and logs in. ref 1 · ref 2 |
live |
| T1204.002 Malicious File | primary impact | This vulnerability is exploited when a user is tricked by an adversary to open a maliciously crafted file either via an email or malicious website. Once the user opens the file, an adversary gains the ability to execute arbitrary code the next time the victim restarts their computer and logs in. ref 1 · ref 2 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1059 Command and Scripting Interpreter secondary impact
- DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 WindowsDetects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.Tunable:
CommandLinePatternParentProcessNameTimeWindowAN1429 LinuxDetects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.Tunable:InterpreterNameUserContextExecutionChainLengthAN1430 macOSDetects launch of command-line interpreters via Terminal, Automator, or hiddenosascript, especially when parent process lineage deviates from user-initiated applications.macos:unifiedloglog stream --info --predicate 'eventMessage CONTAINS "exec"'→ DC0032 Process CreationTunable:LaunchAgentNameScriptNameTerminalAppUsageAN1431 ESXiDetects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.Tunable:ShellEnabledFlagSSHContextAN1432 Network DevicesIdentifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) viaenablemode or scripting-capable sessions used by uncommon accounts or from unknown IPs.Tunable:UserRoleDeviceType
Sigma rules tagged attack.t1059 (95)
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Author: Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Author: Florian Roth (Nextron Systems)
· 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Author: frack113, Tim Shelton (update fp)
· 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
All 95 rules on the technique page →
T1204.002 Malicious File primary impact
- DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
AN0819 WindowsUser opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.Tunable:
TimeWindowSuspiciousExtensionsUserPathsParentAppsSignerAllowListAN0820 macOSUser opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.macos:unifiedlogprocess_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder}→ DC0032 Process Creationmacos:endpointsecurityES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions→ DC0039 File CreationTunable:TimeWindowQuarantineRequiredParentAppsAN0821 LinuxUser or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.auditd:SYSCALLopen/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions→ DC0039 File Creationauditd:SYSCALLexecve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser→ DC0032 Process CreationTunable:TimeWindowDesktopParentMap
Sigma rules tagged attack.t1204.002 (39)
Author: Florian Roth (Nextron Systems)
· 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19
Detects download of certain file types from hosts in suspicious TLDs
Author: Joseph Kamau
· 2024-05-27 (modified 2025-10-07) · logsource: product=windows category=process_creation · 1193d960-2369-499f-a158-7b50a31df682
Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.
Author: Steffen Rogge (dr0pd34d)
· 2024-07-10 · logsource: product=windows category=image_load · 1337afba-d17d-4d23-bd55-29b927603b30
Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.
Author: Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team
· 2022-02-28 (modified 2023-02-04) · logsource: product=windows category=process_creation · 208748f7-881d-47ac-a29c-07ea84bf691d
Detects a suspicious process spawning from an Outlook process.
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2022-08-10 (modified 2025-10-12) · logsource: product=windows category=file_event · 28208707-fe31-437f-9a7f-4b1108b94d2e
Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors.
These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers.
This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.
Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-03 · logsource: product=windows service=appxdeployment-server · 289dfa9e-e378-4a56-a9d4-7ed5ee218029
Detects successful MSIX/AppX package installations on Windows systems by monitoring EventID 854 in the Microsoft-Windows-AppXDeployment-Server/Operational log.
While most installations are legitimate, this can help identify unauthorized or suspicious package installations.
It is crucial to monitor such events as threat actors may exploit MSIX/AppX packages to deliver and execute malicious payloads.
Author: Florian Roth (Nextron Systems)
· 2020-05-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 29fd07fc-9cfd-4331-b7fd-cc18dfa21052
Detects specific process characteristics of Maze ransomware word document droppers
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=linux category=process_creation · 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e
Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.
Author: Pushkarev Dmitry
· 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io
· 2018-04-06 (modified 2023-04-24) · logsource: product=windows category=process_creation · 438025f9-5856-4663-83f7-52f878a70a50
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)
Author: Florian Roth (Nextron Systems)
· 2017-10-25 (modified 2022-08-08) · logsource: category=proxy · 4922a5dd-6743-4fc2-8e81-144374280997
Detects a flashplayer update from an unofficial location
Author: heyyanu
· 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-05-02 (modified 2023-08-17) · logsource: product=windows category=registry_set · 60936b49-fca0-4f32-993d-7415edcf9a5d
A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.
Author: Florian Roth (Nextron Systems)
· 2017-11-23 (modified 2021-11-27) · logsource: product=windows category=process_creation · 678eb5f4-8597-4be6-8be7-905e4234b53a
Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe
Author: Sohan G (D4rkCiph3r)
· 2023-01-31 (modified 2023-02-04) · logsource: product=macos category=process_creation · 69483748-1525-4a6c-95ca-90dc8d431b68
Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution
All 39 rules on the technique page →
T1566 Phishing exploitation technique
- DET0070 Detection Strategy for Phishing across platforms.
AN0188 WindowsUnusual inbound email activity where attachments or embedded URLs are delivered to users followed by execution of new processes or suspicious document behavior. Detection involves correlating email metadata, file creation, and network activity after a phishing message is received.m365:unified
Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types→ DC0038 Application Log ContentTunable:SuspiciousFileTypesAllowedSendersAN0189 LinuxMonitor for malicious payload delivery through phishing where attachments or URLs in email clients (e.g., Thunderbird, mutt) result in unusual file creation or outbound network connections. Focus on correlation between mail logs, file writes, and execution activity.Application:MailInbound messages with anomalous headers, spoofed SPF/DKIM failures→ DC0038 Application Log Contentauditd:SYSCALLexecve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir)→ DC0032 Process CreationTunable:MonitoredMailPathsAttachmentHashBaselineAN0190 macOSDetection of phishing through anomalous Mail app activity, such as attachments saved to disk and immediately executed, or Safari/Preview launching URLs and files linked from email messages. Correlate UnifiedLogs events with subsequent process execution.macos:unifiedlogInbound email activity with suspicious domains or mismatched sender information→ DC0038 Application Log Contentmacos:unifiedlogPreview.app, Safari.app, or Mail.app spawning new processes outside normal patterns→ DC0032 Process CreationTunable:SuspiciousDomainsExecutionDelayWindowAN0191 Office SuitePhishing via Office documents containing embedded macros or links that spawn processes. Detection relies on correlating Office application logs with suspicious child process execution and outbound network connections.m365:unifiedFileAccessed: Access of email attachments by Office applications→ DC0038 Application Log ContentTunable:ParentProcessListMacroExecutionThresholdAN0192 Identity ProviderPhishing attempts targeting IdPs often manifest as anomalous login attempts from suspicious email invitations or fake SSO prompts. Detection correlates login flows, MFA bypass attempts, and anomalous geographic patterns following phishing email delivery.azure:signinlogsFailed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges→ DC0067 Logon Session CreationTunable:GeoAnomalyThresholdMFABypassIndicatorsAN0193 SaaSPhishing delivered via SaaS services (chat, collaboration platforms) where messages contain malicious URLs or attachments. Detect anomalous link clicks, suspicious file uploads, or token misuse after SaaS-based phishing attempts.saas:collaborationMessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom)→ DC0038 Application Log ContentTunable:MonitoredSaaSAppsLinkInspectionPolicy
Sigma rules tagged attack.t1566 (14)
Author: Florian Roth (Nextron Systems)
· 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19
Detects download of certain file types from hosts in suspicious TLDs
Author: Ahmed Farouk
· 2024-05-10 · logsource: category=proxy · 1ae64f96-72b6-48b3-ad3d-e71dff6c6398
Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
Author: Sittikorn S, frack113
· 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Author: jamesc-grafana
· 2024-07-11 (modified 2025-12-08) · logsource: product=aws service=cloudtrail · 38e7f511-3f74-41d4-836e-f57dfa18eead
Detect when System Manager successfully executes commands against an instance.
Author: Micah Babinski
· 2023-08-21 · logsource: product=windows category=file_event · 4c55738d-72d8-490e-a2db-7969654e375f
Detects the creation of WebDAV temporary files with potentially suspicious extensions
Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Sittikorn S
· 2021-07-16 (modified 2022-10-09) · logsource: product=windows category=file_event · ad7085ac-92e4-4b76-8ce2-276d2c0e68ef
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Author: Florian Roth (Nextron Systems)
· 2017-03-13 (modified 2023-05-18) · logsource: category=proxy · b5de2919-b74a-4805-91a7-5049accbaefe
Detects executable downloads from suspicious remote systems
Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
· 2022-10-21 (modified 2023-02-10) · logsource: product=windows category=process_creation · c27515df-97a9-4162-8a60-dc0eeb51b775
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 · logsource: product=windows category=file_event · dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
Author: Maxim Pavlunin
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · e8a95b5e-c891-46e2-b33a-93937d3abc31
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Author: Austin Songer @austinsonger
· 2023-05-07 (modified 2026-04-27) · logsource: product=okta service=okta · ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e
Detects when Okta FastPass prevents a known phishing site.
Author: Florian Roth (Nextron Systems)
· 2022-06-07 · logsource: product=windows category=process_creation · fcdf69e5-a3d3-452a-9724-26f2308bf2b1
Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)