MSDT Execution Via Answer File Without pcwrun.exe
Detects the execution of "msdt.exe" with an answer file, specifically looking for command-line arguments that indicate the use of a diagnostic answer file (PCWDiagnostic.xml) and an answer file flag (-af or /af). This activity is suspicious because it bypasses the legitimate parent process "pcwrun.exe", which is typically used when MSDT is called from the compatibility tab.
Sigma
