Microsoft Diagnostic Tool "DogWalk" Package Path Traversal (Windows Event Log)

id: '11280.15742'
title: Microsoft Diagnostic Tool "DogWalk" Package Path Traversal
description: The vulnerability lies in the Microsoft Diagnostic Tool's sdiageng.dll
  library, which takes the attacker-supplied folder path from the package configuration
  XML file inside the diagcab archive, and copies all files from that folder to a
  local temporary folder. During this process, it enumerates files in attacker's folder,
  gets the file name for each of them, then glues together the local temporary path
  and that file name to generate the local path on the computer where the file is
  to be created.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("msdt.exe" OR TERM(msdt)) AND ("/cab" OR ".diagcab")
  | table _time, host, user process, process_*, parent_*, signature_id, trun_cmd |
  bin span=1s | stats values(*) as * by _time, host | where match(process, "(?i)cab|diagcab") '
techniques:
- execution:user execution
technique_id: 
- T1204
data_category:
- Windows event logs
references:
- https://blog.0patch.com/2022/06/microsoft-diagnostic-tools-dogwalk.html