Windows Process Creation: Renamed msdt.exe Execution
Flags Windows process creation where OriginalFileName is msdt.exe and the executable appears to be a renamed copy.
- Product
- windows
- Category
- process_creation
- Author
- pH-T (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-03
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions where the binary reports OriginalFileName as msdt.exe, while the on-disk image path ends with \msdt.exe, indicating a renamed copy. Attackers may use trusted-looking system utilities under altered filenames to evade detection and maintain stealth. It relies on Windows process creation telemetry with access to the process image path and the file’s OriginalFileName metadata.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Renamed msdt.exe Execution"
id: 376b5486-f819-4517-86cc-052f0e846abf
status: test
description: This rule identifies process executions where the binary reports OriginalFileName as msdt.exe, while the on-disk image path ends with \msdt.exe, indicating a renamed copy. Attackers may use trusted-looking system utilities under altered filenames to evade detection and maintain stealth. It relies on Windows process creation telemetry with access to the process image path and the file’s OriginalFileName metadata.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Msdt/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_msdt.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-06-03
modified: 2023-02-03
tags:
- attack.stealth
- attack.t1036.003
logsource:
category: process_creation
product: windows
detection:
selection:
OriginalFileName: msdt.exe
filter:
Image|endswith: \msdt.exe
condition: selection and not filter
falsepositives:
- Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_msdt/info.yml
license: DRL-1.1
related:
- id: bd1c6866-65fc-44b2-be51-5588fcff82b9
type: derived