Windows: msdt.exe Loads sdiageng.dll via Image Load Events

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows systems where msdt.exe (msdt.exe) loads the diagnostic library sdiageng.dll. Attackers have used msdt.exe to trigger DLL loading as part of exploitation chains, making this a useful behavior indicator when observed in image load telemetry. The detection relies on process image load events indicating both the parent process path ending with \msdt.exe and the loaded module path ending with \sdiageng.dll.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Windows SFTP.exe Indirect Command Execution via ProxyCommand

WSL Process Execution of Kali Linux on Windows

Windows vshadow.exe Proxy Execution via -exec Script/Command

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName

Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line

Windows Process Creation: Execution of Renamed curl.exe via PE Metadata

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows Bash.exe Launched Without Script Execution Arguments

Windows: msdt.exe Loads sdiageng.dll via Image Load Events

Pivot detection · T1202 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-msdt-exe-loading-sdiageng-dll-via-imageload-telemetry-ec8c4047

title: "Windows: msdt.exe Loads sdiageng.dll via Image Load Events"
id: 0293a0e6-714f-4efa-838d-8af70d1acd72
status: test
description: This rule flags Windows systems where msdt.exe (msdt.exe) loads the diagnostic library sdiageng.dll. Attackers have used msdt.exe to trigger DLL loading as part of exploitation chains, making this a useful behavior indicator when observed in image load telemetry. The detection relies on process image load events indicating both the parent process path ending with \msdt.exe and the loaded module path ending with \sdiageng.dll.
references:
  - https://www.securonix.com/blog/detecting-microsoft-msdt-dogwalk/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml
author: Greg (rule), Huntrule Team
date: 2022-06-17
modified: 2023-02-17
tags:
  - attack.stealth
  - attack.t1202
  - cve.2022-30190
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \msdt.exe
    ImageLoaded|endswith: \sdiageng.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ec8c4047-fad9-416a-8c81-0f479353d7f6
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL