This scenario detects some attempts at exploiting [CVE-2022-30190](https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/) on Windows.

It does so by parsing sysmon logs, more specifically the one with event ID 1 (process creation).

This means that you need a working sysmon installation to be able to use this scenario. 