Follina (CVE-2022-30190) or the remote code execution vulnerability discovered that will abuse the Microsoft Windows Support Diagnostic Tool (MSDT.exe) in order to exploit and execute remote code was observed in Late May of 2022. The vulnerability itself was first mentioned by a security research group named “Nao Sec” via Twitter on May 27th and acknowledged by Microsoft on May 31st.
Many adversaries abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core. VB can be abused in Microsoft Office Macros, as standalone script files, within HTA files and run on the command line as a method of evading detection, hiding code or otherwise used as a method of general execution. In the targeted technique, an adversary will utilize a registry key containing an HTA application or vbscript and utilize a script interpreter or rundll32 to run vbscript that will execute the code from the registry. This is a method of defense evasion to hide code in unsuspecting places, but still be able to execute it.