Technical Tip: Using FortiAnalyzer to detect Follina Microsoft Office RCE vulnerability | CVE-2022-30190

[ck_FTNT]

Description	This article describes how to use a custom event handler in FortiAnalyzer to raise alerts for incident response related to attacks that attempt to leverage the Follina Microsoft Office remote code execution vulnerability.
Scope	The event handler and report help to detect attempts to execute remote code using an exploit MSDT (Microsoft Support Diagnostics Tool) based on logs from FortiGates.
Solution	The exploit leverages Word's remote template feature to fetch an HTML file from a server, which then makes use of the 'ms-msdt://' URI scheme to run the malicious payload. For more information, check the FortiGuard outbreak alert. What is included in Fortinet_MSDT_Follina.zip? 1)  MSDT Follina_event-handler.json This event handler helps identify MSDT Follina attacks detected by FortiGates, FortiADC, FortiClient, and FortiProxy logs. 2)  MSDT_Follina_report.dat This report displays the findings on MSDT Follina attacks from FortiGates, FortiADC, FortiClient, and FortiProxy logs. 3)  fgt_MSDT Follina_event-handler.json The event handler for FortiGate ADOMs is configured for FortiGate logs only. 4)  fgt_MSDT Follina_report.dat The report for FortiGate ADOMs includes FortiGate charts only. Steps: 1)  Download the Fortinet_MSDT_Follina.zip file (contains 4 files). 2)  Unzip Fortinet_MSDT_Follina.zip. 3)  Import MSDT Follina_event-handler.json or fgt_MSDT Follina_event-handler.json event handler: - Choose an ADOM (if ADOMs are enabled). The ADOM may be of type Fabric or FortiGate: - Choose the FortiSOC module.  - Select Event Handler List. - Select the Import option under More. - Select the appropriate event handler depending on the ADOM type. Result: The event handler is enabled and will be triggered if the appropriate logs are received following the import of the event handler.  Edit the event handler to customize the notification section. 4)  Import MSDT_Follina_report.dat or fgt_MSDT_Follina_report.dat to Reports: - Choose an ADOM (if ADOMs are enabled). ADOM may be of type Fabric or FortiGate. - Choose the Report module. - Select the Import option under 'More'. Result:  The MSDT_Follina_report can be run anytime as determined by an admin user.