topic CVE-2022-30190 in Endpoint Security

CVE-2022-30190

olfuddyduddy — Tue, 31 May 2022 17:55:29 GMT

Zero Day Exploit of Microsoft Support Diagnostic Tool Detection. What components of Cisco Secure Endpoint will detect and block this vulnerability?

https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/

Re: CVE-2022-30190

Armstnei — Wed, 01 Jun 2022 11:56:30 GMT

I believe they are awaiting a signature update from TALOS to help in detection/prevention.

Re: CVE-2022-30190

sylvain.hamel1 — Wed, 01 Jun 2022 12:25:18 GMT

They added detection this morning. I'm just not sure not sure which engine is picking this and if it will only detect or block/quarantine.

Re: CVE-2022-30190

Armstnei — Wed, 01 Jun 2022 12:31:42 GMT

Behavioral Protection would need to be enabled.

Re: CVE-2022-30190

olfuddyduddy — Wed, 01 Jun 2022 15:36:48 GMT

How is it known that this is Behavioral Detection and not Exploit Prevention, Exploit Prevention-Script Control, System Process Protection, or Malicious Activity Protection? Is there a place to look to confirm this?

Re: CVE-2022-30190

crockbot — Thu, 02 Jun 2022 20:40:41 GMT

Hello S.H.,

Thank you for posting this. If you don't mind sharing a little more, where is this information from? How do I find this information source for future reference? Thank you for any assistance you can provide.

- CB

Re: CVE-2022-30190

sylvain.hamel1 — Thu, 02 Jun 2022 21:25:40 GMT

I found it in the Indicators page (Indicators (cisco.com)

In Analysis-->Indicators of the console.

Re: CVE-2022-30190

sylvain.hamel1 — Thu, 02 Jun 2022 21:27:02 GMT

Just sad that they don't have a published/modified date that we could filter on (so that you can see new Indicators added easily....).

Re: CVE-2022-30190

olfuddyduddy — Thu, 02 Jun 2022 21:44:11 GMT

Thank you Sylvain. I was able to find the same indicator using general search on "msdt". I'm still trying to determine which AMP detection engine is necessary to be certain this is detecting in my enterprise. The indicator doesn't have that information listed on the indicator blurb. Any clues as to how you determined behavioral engine to be the engine necessory to make use of this indicator?