Windows msdt.exe / ms-msdt Handler Arbitrary Command Execution Attempts
Alerts on Windows executions of msdt.exe with command-line indicators suggesting arbitrary command execution.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-05-29
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where msdt.exe is invoked, either by running the msdt.exe binary directly or by referencing it as the original filename. It further requires command-line indicators consistent with diagnostic file browsing and answer file usage (including IT_BrowseForFile= and PCWDiagnostic with the -af parameter). Attackers may use these behaviors to execute arbitrary commands via built-in Microsoft diagnostic components, so correlating process creation with specific command-line patterns is critical. Telemetry relied upon is Windows process creation events including Image/OriginalFileName and CommandLine content.
Reporting behind it
- twitter.comhttps://twitter.com/nao_sec/status/1530196847679401984
- app.any.runhttps://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
- twitter.comhttps://twitter.com/_JohnHammond/status/1531672601067675648
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows msdt.exe / ms-msdt Handler Arbitrary Command Execution Attempts
id: fd3f551c-4d3a-42fe-bda9-0808a017550c
status: test
description: This rule flags Windows process creation where msdt.exe is invoked, either by running the msdt.exe binary directly or by referencing it as the original filename. It further requires command-line indicators consistent with diagnostic file browsing and answer file usage (including IT_BrowseForFile= and PCWDiagnostic with the -af parameter). Attackers may use these behaviors to execute arbitrary commands via built-in Microsoft diagnostic components, so correlating process creation with specific command-line patterns is critical. Telemetry relied upon is Windows process creation events including Image/OriginalFileName and CommandLine content.
references:
- https://twitter.com/nao_sec/status/1530196847679401984
- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
- https://twitter.com/_JohnHammond/status/1531672601067675648
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-05-29
modified: 2024-03-13
tags:
- attack.stealth
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \msdt.exe
- OriginalFileName: msdt.exe
selection_cmd_inline:
CommandLine|contains: IT_BrowseForFile=
selection_cmd_answerfile_flag:
CommandLine|contains: " PCWDiagnostic"
selection_cmd_answerfile_param:
CommandLine|contains|windash: " -af "
condition: selection_img and (selection_cmd_inline or all of selection_cmd_answerfile_*)
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 258fc8ce-8352-443a-9120-8a11e4857fa5
type: derived