Microsoft Support Diagnostic Tool (MSDT) Vulnerability

Verified Officially confirmed Active exploitation confirmed

National Cyber Coordination and Command Centre (NC4) is aware of active exploitation of the zero day vulnerability affecting Microsoft Support Diagnostic Tool (MSDT) in Windows (CVE-2022-30190). This vulnerability can be exploited by an attacker sending a malicious document that utilises Microsoft Word’s external link feature to retrieve the remote malicious file, then using the Microsoft Support Diagnostic Tool to execute PowerShell code. Successful exploitation of the vulnerability will allow an attacker to install programs, view or tamper data, or create new accounts in line with the victim’s user permissions. It can potentially be used to launch attacks towards other resources within the internal network. Proof of Concept (PoC) code to exploit this vulnerability is available online and has been integrated into common exploitation frameworks and tools. Disabling Microsoft Office Macros does not prevent exploitation of this vulnerability.

First observed: 01 Jun 2022
Last checked: 01 Aug 2026
Evidence records: 2
Publication state: Published

What happened?

Current assessment

Why it matters

Information leakage, denial of service, loss of data integrity.

Who is affected?

Affected products and groups

Software: Microsoft Office in Windows platform.

What should you do now?

Actions from official guidance

For technical teams

Organisations are advised to be vigilant and to take the following actions: Official source
Remove the Protocol Handler from system to prevent exploitation Official source
Recommended by Microsoft but advisable to do backup first Use following command as Administrator to remove Protocol Handler: reg delete hkcr\ms-msdt /f Official source
Disable Troubleshooting Wizards Official source
Disabling troubleshooting tools via Group Policy Object (GPO); or Group Policy Editor -> Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Scripted Diagnostics Set “Troubleshooting: Allow users to access and run Troubleshooting Wizards” to “disabled” Use following command as Administrator to disable troubleshooting tools manually: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics" /t REG_DWORD /v EnableDiagnostics /d 0 Official source
Monitor - Process Creation (msdt.exe) Official source
Alert on process execution of msdt.exe with a parent of WinWord.exe using System Monitor (Sysmon) Official source
Monitor - Process Creation (sdiagnhost.exe) Official source
Alert on sdiagnhost.exe creating new processes, particularly those that may represent exploitation Official source
Monitor - Network Connection (WinWord.exe) Official source
To trigger execution, Word must retrieve a linked document that redirects it to the ms-msdt protocol handler Winword.exe regularly makes network connections, but usually only to Microsoft.com and Office.com domains Official source
Monitor - Network Connection (sdiagnhost.exe) Official source
In some cases, a web request will be performed to download additional PowerShell code or tools Official source
Check Office Server Cache Official source
Office store logs that URLs contacted through Office in its own Internet cache The presence of a URL only means it was contacted, not that it was used in an attack Use following command to query the cache: reg query "hkcu\software\microsoft\office\16.0\common\internet\server cache" Official source
Rule from Joe Security only works if you can monitor command line execution Not meant for Office document scanning rule Follina_CVE_2022_30190 { meta: author = "Joe Security" reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e" strings: $msdt1 = "ms-msdt:/id" ascii wide nocase $msdt2 = "ms-msdt:-id" ascii wide nocase $para1 = "IT_RebrowseForFile" ascii wide nocase condition: (1 of ($msdt*) and 1 of ($para*)) } Official source

Which sources support it?

Evidence and official sources

NACSA / NC4 Alerts and AdvisoriesOfficial source
Microsoft Support Diagnostic Tool (MSDT) Vulnerability
National Cyber Coordination and Command Centre (NC4) is aware of active exploitation of the zero day vulnerability affecting Microsoft Support Diagnostic Tool (MSDT) in Windows (CVE-2022-30190). This vulnerability can be exploited by an attacker sending a malicious document that utilises Microsoft Word’s external link feature to retrieve the remote malicious file, then using the Microsoft Support Diagnostic Tool to execute PowerShell code. Successful exploitation of the vulnerability will allow an attacker to install programs, view or tamper data, or create new accounts in line with the victim’s user permissions. It can potentially be used to launch attacks towards other resources within the internal network. Proof of Concept (PoC) code to exploit this vulnerability is available online and has been integrated into common exploitation frameworks and tools. Disabling Microsoft Office Macros does not prevent exploitation of this vulnerability.
Published 01 Jun 2022 · Retrieved 01 Aug 2026
NIST National Vulnerability DatabaseOfficial source
CVE-2022-30190: A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerab…
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
Published 01 Jun 2022 · Retrieved 01 Aug 2026