Windows msdt.exe Execution with Suspicious Parent Process

Alerts when msdt.exe runs under common command-and-script or utility parent processes on Windows.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Nextron Systems (SigmaHQ), DRL 1.1
Published: 2022-06-01
Updated: 2026-07-30

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036Masquerading
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags executions of msdt.exe where the process is launched by a potentially suspicious parent such as cmd.exe, powershell.exe/pwsh.exe, mshta.exe, regsvr32.exe, rundll32.exe, wmic.exe, schtasks.exe, wscript.exe, or wsl.exe. Attackers may use MSDT execution to blend into legitimate Windows tooling while achieving code execution. It relies on Windows process creation telemetry that includes ParentImage and the invoked executable (Image/OriginalFileName).

Reporting behind it

Related detections9 linkedT1036 — drag to rearrange

Suspicious Scripting Interpreter Execution From Downloads Or Temp via Reputation Hijacking

Suspicious MMC Console Loading MSC File From User Writable Path

Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)

Windows renamed dctask64.exe execution via known IMPHASH values

Suspicious GitHub Actions Runner In Hidden Directory via Shell (via process_creation)

Suspicious Billbug Loader Artifacts in Windows Temp Directory

Malicious Scheduled Task Masquerading as Windows Defender Sync via schtasks (via process_creation)

Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)

Malicious PXA Stealer Archive Extraction via Renamed WinRAR images.png (via process_creation)

Windows msdt.exe Execution with Suspicious Parent Process

Pivot detection · T1036 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-msdt-exe-execution-with-suspicious-parent-process-7a74da6b

title: Windows msdt.exe Execution with Suspicious Parent Process
id: 0943c0bf-a5ed-423e-8d6e-cff3936c9091
status: test
description: This rule flags executions of msdt.exe where the process is launched by a potentially suspicious parent such as cmd.exe, powershell.exe/pwsh.exe, mshta.exe, regsvr32.exe, rundll32.exe, wmic.exe, schtasks.exe, wscript.exe, or wsl.exe. Attackers may use MSDT execution to blend into legitimate Windows tooling while achieving code execution. It relies on Windows process creation telemetry that includes ParentImage and the invoked executable (Image/OriginalFileName).
references:
  - https://twitter.com/nao_sec/status/1530196847679401984
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msdt_susp_parent.yml
author: Nextron Systems, Huntrule Team
date: 2022-06-01
modified: 2023-02-06
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \schtasks.exe
      - \wmic.exe
      - \wscript.exe
      - \wsl.exe
  selection_msdt:
    - Image|endswith: \msdt.exe
    - OriginalFileName: msdt.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7a74da6b-ea76-47db-92cc-874ad90df734
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL