Detecting Follina Exploits Using a Remote Answer File

This report documents the Follina (CVE-2022-30190) MSDT remote code execution vulnerability actively exploited via malicious Word documents, explains a bypass technique where an MSDT "answer file" is hosted on an SMB share to avoid common command-line detections, and provides detection guidance (Sigma rule and Defender query) to locate msdt.exe executions referencing SMB-hosted answer files.