huntrule

Windows: msdt.exe Loads sdiageng.dll via Image Load Events

Flags msdt.exe image-load events that load sdiageng.dll, a behavior commonly associated with DLL side-loading abuse.

FreeReviewedSigma · High · v2
Product
windows
Category
image_load
Author
Greg (rule) (SigmaHQ), DRL 1.1
Published
2022-06-17
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows systems where msdt.exe (msdt.exe) loads the diagnostic library sdiageng.dll. Attackers have used msdt.exe to trigger DLL loading as part of exploitation chains, making this a useful behavior indicator when observed in image load telemetry. The detection relies on process image load events indicating both the parent process path ending with \msdt.exe and the loaded module path ending with \sdiageng.dll.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange
Windows SFTP.exe Indirect Command Execution via ProxyCommand
WSL Process Execution of Kali Linux on Windows
Windows vshadow.exe Proxy Execution via -exec Script/Command
Windows ConHost Spawning Suspicious Script and Command-Line Child Processes
Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName
Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line
Windows Process Creation: Execution of Renamed curl.exe via PE Metadata
Suspicious Child Process Creation from BgInfo.EXE on Windows
Windows Bash.exe Launched Without Script Execution Arguments
Windows: msdt.exe Loads sdiageng.dll via Image Load Events
Pivot detection · T1202 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.