Windows msdt.exe Execution with Suspicious Parent Process

Alerts when msdt.exe runs under common command-and-script or utility parent processes on Windows.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Nextron Systems (SigmaHQ), DRL 1.1
Published: 2022-06-01
Updated: 2026-07-30

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036Masquerading
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags executions of msdt.exe where the process is launched by a potentially suspicious parent such as cmd.exe, powershell.exe/pwsh.exe, mshta.exe, regsvr32.exe, rundll32.exe, wmic.exe, schtasks.exe, wscript.exe, or wsl.exe. Attackers may use MSDT execution to blend into legitimate Windows tooling while achieving code execution. It relies on Windows process creation telemetry that includes ParentImage and the invoked executable (Image/OriginalFileName).

Reporting behind it

Related detections9 linkedT1036 — drag to rearrange

Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)

Windows renamed dctask64.exe execution via known IMPHASH values

Suspicious Rclone Exfiltration Masquerading as wininit.exe

Suspicious Executable Running from Public Pictures Directory

Suspicious Python Execution via Renamed Synaptics Binary

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Agent Tesla Persistence via Realtek Named Scheduled Task Batch

Suspicious Interlock Fake Updater Executable Execution

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

Windows msdt.exe Execution with Suspicious Parent Process

Pivot detection · T1036 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-msdt-exe-execution-with-suspicious-parent-process-7a74da6b

title: Windows msdt.exe Execution with Suspicious Parent Process
id: 0943c0bf-a5ed-423e-8d6e-cff3936c9091
status: test
description: This rule flags executions of msdt.exe where the process is launched by a potentially suspicious parent such as cmd.exe, powershell.exe/pwsh.exe, mshta.exe, regsvr32.exe, rundll32.exe, wmic.exe, schtasks.exe, wscript.exe, or wsl.exe. Attackers may use MSDT execution to blend into legitimate Windows tooling while achieving code execution. It relies on Windows process creation telemetry that includes ParentImage and the invoked executable (Image/OriginalFileName).
references:
  - https://twitter.com/nao_sec/status/1530196847679401984
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msdt_susp_parent.yml
author: Nextron Systems, Huntrule Team
date: 2022-06-01
modified: 2023-02-06
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \schtasks.exe
      - \wmic.exe
      - \wscript.exe
      - \wsl.exe
  selection_msdt:
    - Image|endswith: \msdt.exe
    - OriginalFileName: msdt.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7a74da6b-ea76-47db-92cc-874ad90df734
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL