huntrule

Windows msdt.exe Loading sdiageng.dll via ImageLoad Telemetry

Flags msdt.exe image-load events that load sdiageng.dll, a behavior commonly associated with DLL side-loading abuse.

FreeUnreviewedSigmahighv1
title: Windows msdt.exe Loading sdiageng.dll via ImageLoad Telemetry
id: 0293a0e6-714f-4efa-838d-8af70d1acd72
status: test
description: This rule identifies executions where msdt.exe loads the sdiageng.dll library, as indicated by image load events. Attackers can abuse trusted Windows binaries to trigger DLL loading behavior, making this a high-signal indicator of suspicious process activity. The detection relies on Windows image-load telemetry containing both the calling process path (msdt.exe) and the loaded module path (sdiageng.dll).
references:
  - https://www.securonix.com/blog/detecting-microsoft-msdt-dogwalk/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml
author: Greg (rule), Huntrule Team
date: 2022-06-17
modified: 2023-02-17
tags:
  - attack.stealth
  - attack.t1202
  - cve.2022-30190
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \msdt.exe
    ImageLoaded|endswith: \sdiageng.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ec8c4047-fad9-416a-8c81-0f479353d7f6
    type: derived

What it detects

This rule identifies executions where msdt.exe loads the sdiageng.dll library, as indicated by image load events. Attackers can abuse trusted Windows binaries to trigger DLL loading behavior, making this a high-signal indicator of suspicious process activity. The detection relies on Windows image-load telemetry containing both the calling process path (msdt.exe) and the loaded module path (sdiageng.dll).

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.