CVE-2022-30190 - follina

[aneta5]

Hi, Does anyone have some rules that could be implemented to prevent https://www.cyber.gov.au/acsc/view-all-content/alerts/exploitation-microsoft-office-vulnerability-fo... Thanks

[Daveb3d · Accepted solution]

Well I can't link to their Github, so here is a copy and passte:

Rule {
    Process {
        Include OBJECT_NAME { -v "WINWORD.exe" }
        Include OBJECT_NAME { -v "EXCEL.exe" }
        Include OBJECT_NAME { -v "OUTLOOK.exe"}
    }
    Target {
        Match PROCESS {
            Include OBJECT_NAME { -v "msdt.exe" }
            
            Include -access "CREATE"
        }
    }
}

[aneta5]

Thanks!

Can you please translate this into Access Protection rules?

[Daveb3d]

I generally wouldn't if I were you..  you lose command line information, which is helpful for IR.  Access Protection and Expert Rules both use the AAC engine, so it doesn't change performance or anything, other than the bit for extra logged data.  However, if you must, set the parent as the top set of process and the sub rule as a process rule with msdt.exe as the target.  

[tbloudek · Accepted solution]

Can it look like this (?)

Endpoint Security Threat Prevention : Policy Category > Access Protection > 

[cheetah]

Here is an explanation:
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/using-expert-rules-in-ens-10-5-3-to-prevent-mal...

[emrahtolu]

What did you choose as a rule here? 

operations
--any access
--create thread
--change
--terminate
--run

[tbloudek]

I choose them all, ...since I am not sure what I am doing 🙂 no previous experience, so pls take it with no assurance 🙂 best we wait for official McAfee solution

[tbloudek · Accepted solution]

Another aproach using expert rule in Exploit prevention (mentione before the "copy-past-code" and the link to the "how to") could be like this?

[tbloudek]

fyi, in the "how to" they mention the rule checker in GUI of MA-ENS-TP-show_advanced, it gave me "Rule compilation succeeded"