1E Verified
Copyright © 1E 2022 All Rights Reserved
Follina
Downloads
90
Endorsements
13
Components
1
Added
2 years ago
Last Updated
9 months ago
Compatibility
Client Supported - 23.7, 8.1, 8.2, 8.4, 9.0
OS Supported - Microsoft Windows 11, 10, Windows Server 2019, 2016
OS Supported - Microsoft Windows 11, 10, Windows Server 2019, 2016
Description
“Follina,”as reported in Techcrunch and elsewhere ticks all the wrong boxes and impacts 41 Microsoft products including Windows 11 and Office 365. Huntress research even identified a way to have this execute without the user even having to CLICK anything (hovering over the icon can trigger the exploit!).
The good news is that although there is no official patch – Microsoft have issued an advisory which includes information on a registry key you can delete, to mitigate the risk.
Key Features
- Mitigate the Follina vulnerability by running instruction to take Backup and delete MSDT registry hive HKEY_CLASSES_ROOT\ms-msdt.
Setup
- This Product Pack contains instructions.
- Upload the Product pack either with the help of Tachyon Product Pack Deployment Tool or directly by clicking on Upload button from Instruction set in 1E Platform.
- Create an Instruction Set named Follina and move all the instructions from Unassigned Set to this set, unless you use Product Pack Deployment Tool which creates it automatically.
Usage
- Go to Explorer and search for Backup and delete MSDT registry hive HKEY_CLASSES_ROOT\ms-msdt.
- Click Perform this Action.
- This will delete HKLM_CLASSES_ROOT\ms-msdt after taking backup.
Components
1E-Exchange-Action-Follina-MSMSDT-BackupDelete
INSTRUCTION
Description
Backup and delete or restore HKCRms-msdt - used to mitigate the Follina vulnerability, and potentially others. Backup and delete registry to disable the MSDT URL Protocol
Readable Payload
%action% MSDT registry hive HKEY_CLASSES_ROOTms-msdt