Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 992985" data-attributes="member: 32260">From my Follina test (mentioned in the previous posts) I confirmed some interesting facts:<ol>
<li data-xf-list-type="ol">PowerShell was executed only once and only by sdiagnhost.exe . The msdt.exe did not run PowerShell code, but only passed it further to sdiagnhost.exe. I confirmed this by blocking sdiagnhost.exe and watching events&nbsp; ID=53504 and ID=4104 in the Event Log.</li>
<li data-xf-list-type="ol">The fact of blocking the PowerShell scripts by the system-wide policy was not logged. Normally, it is logged as event ID=4100 when powershell.exe runs scripts. When switching ON/OFF this policy the PowerShell was blocked/allowed in the Follina attack.</li>
<li data-xf-list-type="ol">The fact of blocking the PowerShell CmdLines by Constrained Language Mode was not logged. Normally, it is logged as event ID=4100 when powershell.exe runs PowerShell Cmdlines. When switching ON/OFF this restriction the PowerShell was blocked/allowed in the Follina attack.</li>
<li data-xf-list-type="ol">Fortunately, the ScriptBlock is logged (ID=4104) even if sdiagnhost.exe executes PowerShell code so one can control what is happening.</li>
</ol>The infection chain was borrowed from my earlier post in another thread:[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/new-ms-office-zero-day-evades-defender.114090/post-992315[/URL]Edit.The below article (mentioned on the Wilderssecurity forum) was also helpful:[URL unfurl=&quot;true&quot;]https://www.paloaltonetworks.com/blog/security-operations/prevention-hunting-and-playbooks-for-msdt-zero-day-cve-2022-30190/[/URL]</blockquote>

[QUOTE="Andy Ful, post: 992985, member: 32260"] From my Follina test (mentioned in the previous posts) I confirmed some interesting facts: [LIST=1] [*]PowerShell was executed only once and only by sdiagnhost.exe . The msdt.exe did not run PowerShell code, but only passed it further to sdiagnhost.exe. I confirmed this by blocking sdiagnhost.exe and watching events ID=53504 and ID=4104 in the Event Log. [*]The fact of blocking the PowerShell scripts by the system-wide policy was not logged. Normally, it is logged as event ID=4100 when powershell.exe runs scripts. When switching ON/OFF this policy the PowerShell was blocked/allowed in the Follina attack. [*]The fact of blocking the PowerShell CmdLines by Constrained Language Mode was not logged. Normally, it is logged as event ID=4100 when powershell.exe runs PowerShell Cmdlines. When switching ON/OFF this restriction the PowerShell was blocked/allowed in the Follina attack. [*]Fortunately, the ScriptBlock is logged (ID=4104) even if sdiagnhost.exe executes PowerShell code so one can control what is happening. [/LIST] The infection chain was borrowed from my earlier post in another thread: [URL unfurl="true"]https://malwaretips.com/threads/new-ms-office-zero-day-evades-defender.114090/post-992315[/URL] Edit. The below article (mentioned on the Wilderssecurity forum) was also helpful: [URL unfurl="true"]https://www.paloaltonetworks.com/blog/security-operations/prevention-hunting-and-playbooks-for-msdt-zero-day-cve-2022-30190/[/URL] [/QUOTE]

Verification