File Creation In Suspicious Directory By Msdt.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•20

Detects msdt.exe creating files in suspicious directories, which could indicate exploitation of vulnerabilities like Follina (CVE-2022-30190) or Dogwalk. The rule specifically looks for file creations in common startup locations, public user directories, or system logs directories.