Windows Process Execution: msdt.exe Launched with -cab Flag

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where msdt.exe is executed and the command line contains the " -cab " argument. Attackers may use this flag to run troubleshooting components with crafted cabinet-based inputs, which can enable stealthy execution paths. The detection relies on process creation telemetry including the executable path and the full command line.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Windows SFTP.exe Indirect Command Execution via ProxyCommand

WSL Process Execution of Kali Linux on Windows

Windows vshadow.exe Proxy Execution via -exec Script/Command

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName

Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line

Windows Process Creation: Execution of Renamed curl.exe via PE Metadata

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows Bash.exe Launched Without Script Execution Arguments

Windows Process Execution: msdt.exe Launched with -cab Flag

Pivot detection · T1202 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-msdt-exe-launched-with-cab-flag-dc4576d4

title: "Windows Process Execution: msdt.exe Launched with -cab Flag"
id: 886d0c3a-0dc8-4be1-bf13-615d25f0b5cd
related:
  - id: 6545ce61-a1bd-4119-b9be-fcbee42c0cf3
    type: obsolete
  - id: dc4576d4-7467-424f-9eee-fd2b02855fe0
    type: derived
status: test
description: This rule flags Windows process creation events where msdt.exe is executed and the command line contains the " -cab " argument. Attackers may use this flag to run troubleshooting components with crafted cabinet-based inputs, which can enable stealthy execution paths. The detection relies on process creation telemetry including the executable path and the full command line.
references:
  - https://twitter.com/nas_bench/status/1537896324837781506
  - https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-9015912909545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0
  - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msdt_susp_cab_options.yml
author: Nasreddine Bencherchali (Nextron Systems), GossiTheDog, frack113, Huntrule Team
date: 2022-06-21
modified: 2024-03-13
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \msdt.exe
    - OriginalFileName: msdt.exe
  selection_cmd:
    CommandLine|contains|windash: " -cab "
  condition: all of selection_*
falsepositives:
  - Legitimate usage of ".diagcab" files
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL