IR - SOC174-124 - DogWalk 0-Day Activity

Continuing with the Incident Responder Path, we tackle a Windows system apparently post compromise via CVE-2022-34713, aka DogWalk!

EventID: 124
Event Time: Aug. 11, 2022, 7:59 a.m.
Rule: SOC174 - DogWalk 0-Day Activity
Level: Incident Responder
Hostname: Jack-dev-server
Host IP: 172.16.17.81
CVE-ID: CVE-2022-34713
AV Action: Allowed
L1 Note: I saw that the diagcab file was run with msdt.exe at 11.08.2022 07:58. But I did not understand how this happened and what happened next.
Alert Trigger Reason: Running a diagcab file with msdt.exe
NOTES:
https://www.virustotal.com/gui/file/24b28913d95483d94a2b114889937399bdb54e128d255efce5509b0bc3bffa0c

https://www.virustotal.com/gui/file/4c568fa2c2a8248a076931984705447735441847be064e9d6a4ee205164c6982

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34713

Видео IR - SOC174-124 - DogWalk 0-Day Activity канала InfoSec_Bret