Windows msdt.exe Execution with Suspicious Parent Process

Alerts when msdt.exe runs under common command-and-script or utility parent processes on Windows.

FreeUnreviewedSigmahighv1

windows-msdt-exe-execution-with-suspicious-parent-process-7a74da6b

title: Windows msdt.exe Execution with Suspicious Parent Process
id: 0943c0bf-a5ed-423e-8d6e-cff3936c9091
status: test
description: This rule flags executions of msdt.exe where the process is launched by a potentially suspicious parent such as cmd.exe, powershell.exe/pwsh.exe, mshta.exe, regsvr32.exe, rundll32.exe, wmic.exe, schtasks.exe, wscript.exe, or wsl.exe. Attackers may use MSDT execution to blend into legitimate Windows tooling while achieving code execution. It relies on Windows process creation telemetry that includes ParentImage and the invoked executable (Image/OriginalFileName).
references:
  - https://twitter.com/nao_sec/status/1530196847679401984
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msdt_susp_parent.yml
author: Nextron Systems, Huntrule Team
date: 2022-06-01
modified: 2023-02-06
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \schtasks.exe
      - \wmic.exe
      - \wscript.exe
      - \wsl.exe
  selection_msdt:
    - Image|endswith: \msdt.exe
    - OriginalFileName: msdt.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7a74da6b-ea76-47db-92cc-874ad90df734
    type: derived

What it detects

This rule flags executions of msdt.exe where the process is launched by a potentially suspicious parent such as cmd.exe, powershell.exe/pwsh.exe, mshta.exe, regsvr32.exe, rundll32.exe, wmic.exe, schtasks.exe, wscript.exe, or wsl.exe. Attackers may use MSDT execution to blend into legitimate Windows tooling while achieving code execution. It relies on Windows process creation telemetry that includes ParentImage and the invoked executable (Image/OriginalFileName).

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.