Windows Execute Arbitrary Commands with MSDT

The analytic detects arbitrary command execution using Windows msdt.exe, a Diagnostics Troubleshooting Wizard. It identifies instances where msdt.exe is invoked via the ms-msdt:/ protocol handler to retrieve a remote payload. This activity indicates an exploitation attempt leveraging msdt.exe to execute arbitrary commands, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or persist within the environment, posing a severe security risk.