Windows msdt.exe execution using PCWDiagnostic.xml answer file

Alerts on msdt.exe launched with PCWDiagnostic.xml and an answer-file argument, excluding cases from pcwrun.exe.

FreeUnreviewedSigmahighv1

windows-msdt-exe-execution-using-pcwdiagnostic-xml-answer-file-9c8c7000

title: Windows msdt.exe execution using PCWDiagnostic.xml answer file
id: 542a745f-51e7-432e-8184-fc23419cf2ba
status: test
description: This rule flags process creation events where msdt.exe is launched with a command line referencing \WINDOWS\diagnostics\index\PCWDiagnostic.xml and includes an answer-file argument ( -af ). Attackers may use this execution pattern to mimic legitimate diagnostic tooling behavior while running arbitrary logic through the msdt utility. It relies on Windows process creation telemetry, including the spawned Image path, full CommandLine, and the parent process name to exclude the specific expected parent (pcwrun.exe).
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Msdt/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msdt_answer_file_exec.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-13
modified: 2025-10-29
tags:
  - attack.stealth
  - attack.t1218
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \msdt.exe
    CommandLine|contains: \WINDOWS\diagnostics\index\PCWDiagnostic.xml
    CommandLine|contains|windash: " -af "
  filter_main_pcwrun:
    ParentImage|endswith: \pcwrun.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Possible undocumented parents of "msdt" other than "pcwrun".
level: high
license: DRL-1.1
related:
  - id: 9c8c7000-3065-44a8-a555-79bcba5d9955
    type: derived

What it detects

This rule flags process creation events where msdt.exe is launched with a command line referencing \WINDOWS\diagnostics\index\PCWDiagnostic.xml and includes an answer-file argument ( -af ). Attackers may use this execution pattern to mimic legitimate diagnostic tooling behavior while running arbitrary logic through the msdt utility. It relies on Windows process creation telemetry, including the spawned Image path, full CommandLine, and the parent process name to exclude the specific expected parent (pcwrun.exe).

Known false positives

Possible undocumented parents of "msdt" other than "pcwrun".

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.