MSDT Execution Via Answer File

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab).

Known false positives

Possible undocumented parents of "msdt" other than "pcwrun".

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: MSDT Execution Via Answer File
id: 9c8c7000-3065-44a8-a555-79bcba5d9955
status: test
description: |
    Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab).
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Msdt/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-13
modified: 2025-10-29
tags:
    - attack.stealth
    - attack.t1218
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\msdt.exe'
        CommandLine|contains: '\WINDOWS\diagnostics\index\PCWDiagnostic.xml'
        CommandLine|contains|windash: ' -af '
    filter_main_pcwrun:
        ParentImage|endswith: '\pcwrun.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Possible undocumented parents of "msdt" other than "pcwrun".
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    Image|endswith: '\msdt.exe'
    CommandLine|contains: '\WINDOWS\diagnostics\index\PCWDiagnostic.xml'
    CommandLine|contains|windash: ' -af '

Stage 2: `not filter_main_pcwrun`

filter_main_pcwrun:
    ParentImage|endswith: '\pcwrun.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ParentImage`	ends_with	`\pcwrun.exe`	`excludes:ParentImage` `field:"ParentImage" value:"\pcwrun.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-af` transforms: `windash` corpus 3 (sigma 3) `\WINDOWS\diagnostics\index\PCWDiagnostic.xml`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\msdt.exe` corpus 9 (sigma 9)	`field:"Image" kind:ends_with value:"\msdt.exe"`