Windows PowerShell: Execution of TroubleshootingPack Cmdlets (msdt-related usage)

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell script block text that invokes TroubleshootingPack with the PCW diagnostics path and unattended answering options. Attackers may use this pattern to run troubleshooting pack components in a way that can support exploitation chains involving msdt-like behavior. Detection relies on PowerShell Script Block Logging telemetry capturing the specific cmdlet invocation, file path, and parameters.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Windows SFTP.exe Indirect Command Execution via ProxyCommand

WSL Process Execution of Kali Linux on Windows

Windows vshadow.exe Proxy Execution via -exec Script/Command

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName

Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line

Windows Process Creation: Execution of Renamed curl.exe via PE Metadata

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows Bash.exe Launched Without Script Execution Arguments

Windows PowerShell: Execution of TroubleshootingPack Cmdlets (msdt-related usage)

Pivot detection · T1202 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-execution-of-troubleshootingpack-cmdlet-for-unattended-troubl-03409c93

title: "Windows PowerShell: Execution of TroubleshootingPack Cmdlets (msdt-related usage)"
id: 8db0dbc1-1644-4277-9397-ca95f451c81e
status: test
description: This rule identifies PowerShell script block text that invokes TroubleshootingPack with the PCW diagnostics path and unattended answering options. Attackers may use this pattern to run troubleshooting pack components in a way that can support exploitation chains involving msdt-like behavior. Detection relies on PowerShell Script Block Logging telemetry capturing the specific cmdlet invocation, file path, and parameters.
references:
  - https://twitter.com/nas_bench/status/1537919885031772161
  - https://lolbas-project.github.io/lolbas/Binaries/Msdt/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_follina_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-21
tags:
  - attack.stealth
  - attack.t1202
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Invoke-TroubleshootingPack
      - C:\Windows\Diagnostics\System\PCW
      - -AnswerFile
      - -Unattended
  condition: selection
falsepositives:
  - Legitimate usage of "TroubleshootingPack" cmdlet for troubleshooting purposes
level: medium
license: DRL-1.1
related:
  - id: 03409c93-a7c7-49ba-9a4c-a00badf2a153
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL