• 5ffd57393a85553ab55b
• 5cd28e2a812e5c65c9f7320e0726da18
• b6a6676a84b51c8200d0673a5b4a87c5
The quotes on this page come from this deleted question on Stackoverflow:
| title: Suspicious msdt.exe execution - Office Exploit | |
| id: 97a80ed7-1f3f-4d05-9ef4-65760e634f6b | |
| status: experimental | |
| description: This rule will monitor suspicious arguments passed to the msdt.exe process. These arguments are an indicator of recent Office/Msdt exploitation. | |
| references: | |
| - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e | |
| - https://twitter.com/MalwareJake/status/1531019243411623939 | |
| author: 'Matthew Brennan' | |
| tags: | |
| - attack.execution |
The quotes on this page come from this deleted question on Stackoverflow: