huntrule

Windows msdt.exe / ms-msdt Handler Arbitrary Command Execution Attempts

Alerts on Windows executions of msdt.exe with command-line indicators suggesting arbitrary command execution.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-05-29
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation where msdt.exe is invoked, either by running the msdt.exe binary directly or by referencing it as the original filename. It further requires command-line indicators consistent with diagnostic file browsing and answer file usage (including IT_BrowseForFile= and PCWDiagnostic with the -af parameter). Attackers may use these behaviors to execute arbitrary commands via built-in Microsoft diagnostic components, so correlating process creation with specific command-line patterns is critical. Telemetry relied upon is Windows process creation events including Image/OriginalFileName and CommandLine content.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange
Windows SFTP.exe Indirect Command Execution via ProxyCommand
WSL Process Execution of Kali Linux on Windows
Windows vshadow.exe Proxy Execution via -exec Script/Command
Windows ConHost Spawning Suspicious Script and Command-Line Child Processes
Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName
Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line
Windows Process Creation: Execution of Renamed curl.exe via PE Metadata
Suspicious Child Process Creation from BgInfo.EXE on Windows
Windows Bash.exe Launched Without Script Execution Arguments
Windows msdt.exe / ms-msdt Handler Arbitrary Command Execution Attempts
Pivot detection · T1202 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.