Windows msdt.exe Creating Files in Suspicious Directories

Alerts when msdt.exe writes files to high-suspicion directories that may indicate persistence after exploitation.

FreeUnreviewedSigmahighv1

windows-msdt-exe-creating-files-in-suspicious-directories-318557a5

title: Windows msdt.exe Creating Files in Suspicious Directories
id: 98fad3f4-b5e2-44a5-b690-b98b9ef3fe6a
status: test
description: This rule flags activity where msdt.exe creates files under directories commonly associated with user startup, public persistence, or diagnostic/storage locations. Such file creation from a diagnostic troubleshooter binary can indicate attempts to persist or execute follow-on stages after exploitation. It relies on Windows file event telemetry capturing the executing process path (ending in \msdt.exe) and the target filename paths created.
references:
  - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd
  - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_msdt_susp_directories.yml
author: Vadim Varganov, Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-24
modified: 2023-02-23
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
  - cve.2022-30190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \msdt.exe
    TargetFilename|contains:
      - \Desktop\
      - \Start Menu\Programs\Startup\
      - C:\PerfLogs\
      - C:\ProgramData\
      - C:\Users\Public\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 318557a5-150c-4c8d-b70e-a9910e199857
    type: derived

What it detects

This rule flags activity where msdt.exe creates files under directories commonly associated with user startup, public persistence, or diagnostic/storage locations. Such file creation from a diagnostic troubleshooter binary can indicate attempts to persist or execute follow-on stages after exploitation. It relies on Windows file event telemetry capturing the executing process path (ending in \msdt.exe) and the target filename paths created.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.