Suspicious Cabinet File Execution Via Msdt.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•0•19

Detects the execution of 'msdt.exe' with the '-cab' flag, which is indicative of suspicious diagnostic cabinet (.diagcab) files potentially leveraging CVE-2022-30190 (Follina vulnerability) to execute embedded answer files. This technique can be used for defense evasion and indirect command execution.