Suspicious Microsoft Diagnostics Wizard Execution

  1[metadata]
  2creation_date = "2022/05/31"
  3integration = ["endpoint", "windows", "m365_defender", "crowdstrike", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or
 11binary execution via malicious process arguments.
 12"""
 13from = "now-9m"
 14index = [
 15    "logs-endpoint.events.process-*",
 16    "winlogbeat-*",
 17    "logs-windows.sysmon_operational-*",
 18    "endgame-*",
 19    "logs-m365_defender.event-*",
 20    "logs-crowdstrike.fdr*",
 21    "logs-sentinel_one_cloud_funnel.*",
 22]
 23language = "eql"
 24license = "Elastic License v2"
 25name = "Suspicious Microsoft Diagnostics Wizard Execution"
 26references = [
 27    "https://twitter.com/nao_sec/status/1530196847679401984",
 28    "https://lolbas-project.github.io/lolbas/Binaries/Msdt/",
 29]
 30risk_score = 73
 31rule_id = "2c3c29a4-f170-42f8-a3d8-2ceebc18eb6a"
 32severity = "high"
 33tags = [
 34    "Domain: Endpoint",
 35    "OS: Windows",
 36    "Use Case: Threat Detection",
 37    "Tactic: Defense Evasion",
 38    "Data Source: Elastic Endgame",
 39    "Data Source: Elastic Defend",
 40    "Data Source: Microsoft Defender XDR",
 41    "Data Source: Sysmon",
 42    "Data Source: Crowdstrike",
 43    "Data Source: SentinelOne",
 44    "Resources: Investigation Guide",
 45    "Noise: Medium",
 46    "Performance: Normal",
 47    "Profile: Recommended",
 48    "Threat: Living off the Land",
 49    "Rule Type: Event Correlation (EQL)",
 50    "Platform: Windows",
 51]
 52timestamp_override = "event.ingested"
 53type = "eql"
 54
 55query = '''
 56process where host.os.type == "windows" and event.type == "start" and
 57  (?process.pe.original_file_name == "msdt.exe" or process.name : "msdt.exe") and
 58  (
 59    process.args : ("IT_RebrowseForFile=*", "*FromBase64*", "*/../../../*", "IT_BrowseForFile=*") or
 60    (
 61      process.args : ("-af", "/af") and process.args : "/skip" and
 62      process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe") and
 63      process.args : ("?:\\WINDOWS\\diagnostics\\index\\PCWDiagnostic.xml", "PCWDiagnostic.xml", "?:\\Users\\Public\\*", "?:\\Windows\\Temp\\*")
 64    ) or
 65
 66    (process.pe.original_file_name == "msdt.exe" and not process.name : "msdt.exe" and process.name != null) or
 67
 68    (
 69      ?process.pe.original_file_name == "msdt.exe" and
 70      not process.executable : (
 71        "?:\\Windows\\system32\\msdt.exe",
 72        "?:\\Windows\\SysWOW64\\msdt.exe",
 73        /* Crowdstrike specific exclusion as it uses NT Object paths */
 74        "\\Device\\HarddiskVolume*\\Windows\\system32\\msdt.exe",
 75        "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\msdt.exe"
 76      )
 77    )
 78  )
 79'''
 80
 81note = """## Triage and analysis
 82
 83### Investigating Suspicious Microsoft Diagnostics Wizard Execution
 84
 85#### Possible investigation steps
 86
 87- Does the alert show MSDT proxy-execution behavior or a bounded diagnostic launch?
 88  - Why: MSDT abuse depends on PCWDiagnostic answer files, rebrowse or browse-file parameters, traversal, or encoded input, not on "msdt.exe" alone.
 89  - Focus: `process.command_line` and `process.args`, classifying answer-file use, rebrowse or browse-file parameters, encoded input, traversal, and package location.
 90  - Implication: escalate when arguments point to attacker-controlled content, encoded or traversal input, or user-writable answer files; lower concern only when they resolve to a recognized local diagnostic pack with no external, encoded, traversal, or user-writable references.
 91
 92- Do binary identity and launcher lineage fit a legitimate diagnostic launch?
 93  - Focus: `process.executable`, `process.pe.original_file_name`, `process.code_signature.trusted`, `process.parent.executable`, and `process.parent.command_line`.
 94  - Implication: escalate when MSDT is renamed, relocated, unsigned or untrusted, or launched by Office, a browser, script host, "mshta.exe", "rundll32.exe", "regsvr32.exe", or a shell using profile or temp content; lower concern when a trusted Windows MSDT path and signed helpdesk, OEM, or management parent launch the same diagnostic pack.
 95
 96- Did MSDT or a diagnostic-host child launch another binary or script?
 97  - Focus: child process events where `process.parent.entity_id` matches alert `process.entity_id`; record child `process.entity_id`, `process.executable`, `process.command_line`, and `process.code_signature.trusted`. $investigate_0
 98  - Hint: if the first child is a signed diagnostic host, inspect that child's descendants before treating the chain as contained.
 99  - Implication: escalate when MSDT or its diagnostic-host child launches shells, script interpreters, "mshta.exe", "regsvr32.exe", "rundll32.exe", unsigned payloads, or content from user-writable paths; lower concern when the child chain stays inside expected Microsoft or OEM diagnostic components.
100
101- Do file events show package staging or later execution?
102  - Focus: if file telemetry exists, pivot with `host.id` plus alert `process.entity_id`, parent `process.parent.entity_id`, direct-child parent linkage, and exact referenced paths when present; otherwise use `host.id`, `process.pid`, and alert-time window for referenced path, provenance, write timing, and later execution. Missing file telemetry is unresolved, not benign. $investigate_1
103  - Implication: escalate when the package appears in Public, Temp, profile, share, or newly written staging paths, carries web or archive provenance, or later executes; lower concern only when artifact evidence stays bound to the same recognized diagnostic package.
104
105- If remote delivery is suggested, do optional network events show retrieval or external control?
106  - Focus: when network telemetry exists, query with `host.id` plus alert `process.entity_id` or alert-backed `process.parent.entity_id`, separating DNS from connections. Review child-process network activity from recovered child results. Missing network telemetry is unresolved, not benign. $investigate_2
107  - Implication: escalate when the parent, MSDT, or child chain retrieves remote HTML/package content or contacts unrelated infrastructure; lower concern only when available network evidence stays local or vendor-aligned with the same diagnostic package.
108
109- If local evidence is suspicious or unresolved, does related alert history broaden scope?
110  - Focus: compare related alerts for `user.id` and `host.id` over 48 hours for recurring MSDT command patterns, parent launchers, package paths, child payloads, or remote indicators. $investigate_3 $investigate_4
111  - Implication: broaden scope when the same proxy-execution pattern appears across unrelated hosts or users; keep response local only when current process, file, child, and network evidence bind one recognized diagnostic workflow.
112
113- What disposition is supported?
114  - Weigh command-line intent, image identity, parent lineage, package evidence, child or descendant processes, and file or network corroboration; escalate proxy execution or payload delivery, close only when evidence binds one recognized diagnostic workflow, and preserve artifacts when evidence is mixed or incomplete.
115
116### False positive analysis
117
118- Helpdesk, OEM troubleshooting, software deployment, or validation can trigger this rule when a signed support or management parent starts Microsoft-signed MSDT from a standard Windows path, uses the same controlled local diagnostic pack, and produces the same child-process set. Close only when parent path and command line, MSDT path and signature, command line, package path, child behavior, `user.id`, and `host.id` align in the current case; records can corroborate but not replace telemetry.
119- Do not create exceptions on `process.name`, `process.pe.original_file_name`, or Microsoft signature alone.
120
121### Response and remediation
122
123- If confirmed benign:
124  - Reverse temporary containment and document the process, parent, package, and child-process evidence. Build exceptions only from the confirmed parent path plus command-line/package pattern plus `host.id` or `user.id`, not from "msdt.exe" alone.
125- If suspicious but unconfirmed:
126  - Preserve the alert, MSDT `process.entity_id`, `process.pid`, `process.command_line`, `process.args`, parent evidence, package path, child identifiers, suspicious package copies, and remote indicators.
127  - Apply reversible containment for the affected `host.id` and `user.id`, such as temporary network restrictions, heightened monitoring, or child-process blocking. Isolate only for spawned payload behavior or high host criticality.
128- If confirmed malicious:
129  - Isolate the host or escalate after preserving the MSDT and child identifiers, package paths, payload paths, command lines, and remote indicators.
130  - Terminate MSDT, diagnostic-host, and payload processes only after recording identifiers; block malicious child binaries, package paths, domains, and IP indicators.
131  - Remove malicious ".xml", ".msi", ".diagcab", remote package, or payload artifacts, then remediate the parent document, browser, script, or management path.
132- Post-incident hardening:
133  - Restrict MSDT where business use no longer requires it, verify Follina-era mitigations, and retain process, file, and network telemetry for MSDT, parents, and children.
134"""
135
136setup = """## Setup
137
138This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
139
140Setup instructions: https://ela.st/install-elastic-defend
141
142### Additional data sources
143
144This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
145
146- [CrowdStrike](https://ela.st/crowdstrike-integration)
147- [Microsoft Defender XDR](https://ela.st/m365-defender)
148- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
149- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
150"""
151
152[rule.investigation_fields]
153field_names = [
154    "@timestamp",
155    "host.name",
156    "host.id",
157    "user.name",
158    "user.id",
159    "process.entity_id",
160    "process.pid",
161    "process.executable",
162    "process.command_line",
163    "process.args",
164    "process.pe.original_file_name",
165    "process.code_signature.trusted",
166    "process.parent.entity_id",
167    "process.parent.executable",
168    "process.parent.command_line",
169]
170
171[transform]
172
173[[transform.investigate]]
174label = "Child process events for the same MSDT instance"
175description = ""
176providers = [
177  [
178    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
179    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
180    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
181  ]
182]
183relativeFrom = "now-1h"
184relativeTo = "now"
185
186[[transform.investigate]]
187label = "File events for parent and child processes"
188description = ""
189providers = [
190  [
191    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
192    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
193    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
194  ],
195  [
196    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
197    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
198    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" }
199  ],
200  [
201    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
202    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
203    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
204  ]
205]
206relativeFrom = "now-1h"
207relativeTo = "now"
208
209[[transform.investigate]]
210label = "Network and DNS events for MSDT or its parent"
211description = ""
212providers = [
213  [
214    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
215    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
216    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
217  ],
218  [
219    { excluded = false, field = "event.category", queryType = "phrase", value = "dns", valueType = "string" },
220    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
221    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
222  ],
223  [
224    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
225    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
226    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" }
227  ],
228  [
229    { excluded = false, field = "event.category", queryType = "phrase", value = "dns", valueType = "string" },
230    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
231    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" }
232  ]
233]
234relativeFrom = "now-1h"
235relativeTo = "now"
236
237[[transform.investigate]]
238label = "Alerts associated with the user"
239description = ""
240providers = [
241  [
242    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
243    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
244  ]
245]
246relativeFrom = "now-48h/h"
247relativeTo = "now"
248
249[[transform.investigate]]
250label = "Alerts associated with the host"
251description = ""
252providers = [
253  [
254    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
255    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
256  ]
257]
258relativeFrom = "now-48h/h"
259relativeTo = "now"
260
261[[rule.threat]]
262framework = "MITRE ATT&CK"
263
264[[rule.threat.technique]]
265id = "T1036"
266name = "Masquerading"
267reference = "https://attack.mitre.org/techniques/T1036/"
268
269[[rule.threat.technique.subtechnique]]
270id = "T1036.003"
271name = "Rename Legitimate Utilities"
272reference = "https://attack.mitre.org/techniques/T1036/003/"
273
274[[rule.threat.technique]]
275id = "T1218"
276name = "System Binary Proxy Execution"
277reference = "https://attack.mitre.org/techniques/T1218/"
278
279[rule.threat.tactic]
280id = "TA0005"
281name = "Defense Evasion"
282reference = "https://attack.mitre.org/tactics/TA0005/"