Follina MSDT Mitigation

[zgerber08]

The Malwarebytes Business Support FAQ page for Follina mitigation mentioned manually adding sdiagnhost.exe as a new protected application within policies for immediate mitigation. The June 6 Nebula release notes include Malwarebytes adding "support against the zero-day "Follina" exploit." While the release notes didn't detail the changes, I see that the sdiagnhost.exe application has been automatically added and enabled for all Nebula policies, which were updated by Malwarebytes on June 6.

https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/06/faq-mitigating-microsoft-offices-follina-zero-day/

 

Were there any other Follina-focused changes made as part of that June 6 release? Also, by having sdiagnhost.exe present on the protected application list, should we expect any changes in Windows behavior? How does Malwarebytes' enforcement of this protected application layer compare to Microsoft's recommended mitigations?

[Malwarebytes]

*** This is an automated reply ***

 

Thanks for posting in the Malwarebytes Business section of the forum

For self-help articles, please see the following link
https://service.malwarebytes.com/hc/en-us

If you're unable to locate an answer from the articles in that link or here on the forums, you're more than welcome to post a new question.

Please note that if you do need direct support, please create a support ticket from the following link.

Business Support
https://service.malwarebytes.com/hc/en-us/requests/new

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team