Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
This rule detects the loading of 'sdiageng.dll' by 'msdt.exe'. This specific combination is known to be exploited by vulnerabilities such as CVE-2022-30190 (Follina) and DogWalk, which leverage msdt.exe for arbitrary code execution by loading a diagnostic library.
Sigma
