{"id":"258fc8ce-8352-443a-9120-8a11e4857fa5","title":"Potential Arbitrary Command Execution Using Msdt.EXE","description":"Detects processes leveraging the \"ms-msdt\" handler or the \"msdt.exe\" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-05-29","modified":"2024-03-13","tags":["attack.stealth","attack.t1202"],"technique_ids":["T1202"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/nao_sec/status/1530196847679401984","https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/","https://twitter.com/_JohnHammond/status/1531672601067675648"],"source_path":"rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml","source_sha256":"dd9c9b91d3ac405f5fe56415e1c52f784d7d29377d256cb652978f474dbbcc91","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Arbitrary Command Execution Using Msdt.EXE\nid: 258fc8ce-8352-443a-9120-8a11e4857fa5\nstatus: test\ndescription: Detects processes leveraging the \"ms-msdt\" handler or the \"msdt.exe\" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability\nreferences:\n    - https://twitter.com/nao_sec/status/1530196847679401984\n    - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/\n    - https://twitter.com/_JohnHammond/status/1531672601067675648\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-05-29\nmodified: 2024-03-13\ntags:\n    - attack.stealth\n    - attack.t1202\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\msdt.exe'\n        - OriginalFileName: 'msdt.exe'\n    selection_cmd_inline:\n        CommandLine|contains: 'IT_BrowseForFile='\n    selection_cmd_answerfile_flag:\n        CommandLine|contains: ' PCWDiagnostic'\n    selection_cmd_answerfile_param:\n        CommandLine|contains|windash: ' -af '\n    condition: selection_img and (selection_cmd_inline or all of selection_cmd_answerfile_*)\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","page":"techniques/enterprise/T1202/"}],"data_path":"data/detection-rules/258fc8ce-8352-443a-9120-8a11e4857fa5.json","kind":"sigma"}