Renamed Msdt.exe Execution
This rule detects the execution of the Microsoft Support Diagnostic Tool (msdt.exe) when its executable file has been renamed. Adversaries often rename legitimate system utilities to evade detection mechanisms that might be looking for the original executable name. By checking for the original filename 'msdt.exe' in the process metadata while ensuring the image path does not end with '\msdt.exe', the rule identifies instances where the utility is run under a different name.
Sigma
