Windows msdt.exe / ms-msdt Handler Arbitrary Command Execution Attempts

title: Windows msdt.exe / ms-msdt Handler Arbitrary Command Execution Attempts
id: fd3f551c-4d3a-42fe-bda9-0808a017550c
status: test
description: This rule flags Windows process creation where msdt.exe is invoked, either by running the msdt.exe binary directly or by referencing it as the original filename. It further requires command-line indicators consistent with diagnostic file browsing and answer file usage (including IT_BrowseForFile= and PCWDiagnostic with the -af parameter). Attackers may use these behaviors to execute arbitrary commands via built-in Microsoft diagnostic components, so correlating process creation with specific command-line patterns is critical. Telemetry relied upon is Windows process creation events including Image/OriginalFileName and CommandLine content.
references:
  - https://twitter.com/nao_sec/status/1530196847679401984
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
  - https://twitter.com/_JohnHammond/status/1531672601067675648
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-05-29
modified: 2024-03-13
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \msdt.exe
    - OriginalFileName: msdt.exe
  selection_cmd_inline:
    CommandLine|contains: IT_BrowseForFile=
  selection_cmd_answerfile_flag:
    CommandLine|contains: " PCWDiagnostic"
  selection_cmd_answerfile_param:
    CommandLine|contains|windash: " -af "
  condition: selection_img and (selection_cmd_inline or all of selection_cmd_answerfile_*)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 258fc8ce-8352-443a-9120-8a11e4857fa5
    type: derived