Windows Process Creation: Renamed msdt.exe Execution

title: "Windows Process Creation: Renamed msdt.exe Execution"
id: 376b5486-f819-4517-86cc-052f0e846abf
status: test
description: This rule identifies process executions where the binary reports OriginalFileName as msdt.exe, while the on-disk image path ends with \msdt.exe, indicating a renamed copy. Attackers may use trusted-looking system utilities under altered filenames to evade detection and maintain stealth. It relies on Windows process creation telemetry with access to the process image path and the file’s OriginalFileName metadata.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Msdt/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_msdt.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-06-03
modified: 2023-02-03
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName: msdt.exe
  filter:
    Image|endswith: \msdt.exe
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_msdt/info.yml
license: DRL-1.1
related:
  - id: bd1c6866-65fc-44b2-be51-5588fcff82b9
    type: derived