Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
19
5
4
1
1
Contributors
19
5
4
1
1
Categories
20
9
5
3
2
Platforms
30
1
Products / Services
14
11
5
4
2
MITRE Techniques
18
13
8
8
7
CVEs
71
71
64
58
49
30
IDS Classtypes
1
IDS Protocols
1
The analytic detects arbitrary command execution using Windows msdt.exe, a Diagnostics Troubleshooting Wizard. It identifies instances where msdt.exe is invoked via the ms-msdt:/ protocol handler to retrieve a remote payload. This activity indicates an exploitation attempt leveraging msdt.exe to execute arbitrary commands, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or persist within the environment, posing a severe security risk.
The analytic identifies path traversal command-line executions, leveraging data from Endpoint Detection and Response (EDR) agents. It detects patterns in command-line arguments indicative of path traversal techniques, such as multiple instances of "/..", "\..", or "\\..". This activity is significant as it often indicates attempts to evade defenses by executing malicious code, such as through msdt.exe. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
Detects modifications to the 'ms-msdt' URI scheme in the Windows Registry, specifically when the 'TargetObject' starts with 'HKCR\ms-msdt\'. This activity could indicate an attempt to exploit CVE-2022-30190, a Microsoft Support Diagnostic Tool (MSDT) vulnerability, often referred to as "Follina". The vulnerability allows for remote code execution via specially crafted Microsoft Office documents.
Detects the 'sdiagnhost.exe' process launching suspicious child processes, which has been observed in exploits like Follina (CVE-2022-30190). The rule specifically looks for sdiagnhost.exe as a parent process and a list of common Living Off The Land Binaries (LOLBins) or other suspicious executables as child processes. It includes filters to reduce false positives related to common command-line arguments for cmd.exe and powershell.exe.
Detects Microsoft Office applications executing child processes that include directory traversal patterns in their command line. This behavior is indicative of exploitation attempts, specifically referencing vulnerabilities like CVE-2022-30190 (MSDT RCE, also known as Follina) and CVE-2021-40444 (MSHTML RCE). The rule looks for common Office applications as parent processes and specific directory traversal strings in the child process's command line.
Detects suspicious child processes spawned from Microsoft Outlook. This often indicates an attempt to execute malicious code or scripts via social engineering or exploitation of vulnerabilities within Outlook.
This rule detects the loading of 'sdiageng.dll' by 'msdt.exe'. This specific combination is known to be exploited by vulnerabilities such as CVE-2022-30190 (Follina) and DogWalk, which leverage msdt.exe for arbitrary code execution by loading a diagnostic library.
This rule detects the execution of PowerShell cmdlets related to 'TroubleshootingPack' with specific arguments, which could indicate an attempt to leverage vulnerabilities like CVE-2022-30190 (Follina) or similar techniques used by the 'msdt' LOLBIN (Living Off the Land Binaries). The detection specifically looks for the combination of 'Invoke-TroubleshootingPack', the path 'C:\Windows\Diagnostics\System\PCW', '-AnswerFile', and '-Unattended' within the PowerShell script block text. This pattern is indicative of an attempt to execute diagnostic packages in an unattended manner, often exploited for arbitrary code execution.
Detects the execution of msdt.exe by a suspicious parent process, which is indicative of exploitation techniques such as the 'Follina' vulnerability (CVE-2022-30190). The rule specifically looks for msdt.exe being spawned by common scripting or system utility processes often abused in such attacks.
Page 2 of 2