MSDT Execution Via Answer File

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab).