MSDT Follina Exploit Detection
This detection identifies potential exploitation of the Microsoft Support Diagnostic Tool (MSDT) vulnerability, also known as "Follina" (CVE-2022-30190), which allows remote code execution through specially crafted Microsoft Office documents.
Microsoft Sentinel (KQL)

