Query: detect Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun. in logs
Matching passage: Sigma rule: Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.. Logsource: windows / process_creation. Rule: title: MSDT Execution Via Answer File id: 9c8c7000-3065-44a8-a555-79bcba5d9955 status: test description: 'Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab). ' references: - https://lolbas-project.github.io/lolbas/Binaries/Msdt/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-13 modified: 2025-10-29 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: Image|endswith: \msdt.exe CommandLine|contains: \WINDOWS\diagnostics\index\PCWDiagnostic.xml CommandLine|contains|windash: ' -af ' filter_main_pcwrun: ParentImage|endswith: \pcwrun.exe condition: selection and not 1 of filter_main_* falsepositives: - Possible undocumented parents of "msdt" other than "pcwrun". level: high
Near-miss passage: Sigma rule: Shadow Copies deletion using operating systems utilities. Logsource: windows / process_creation. Rule: title: Shadow Copies Deletion Using Operating Systems Utilities id: c947b146-0abc-4c87-9c64-b17e9d7274a2 status: stable description: Shadow Copies deletion using operating systems utilities references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://blog.talosintelligence.com/2017/05/wannacry.html - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/ - https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/ - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100 - https://github.com/Neo23x0/Raccine#the-process - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar - https://redcanary.com/blog/intelligence-insights-october-2021/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades) date: 2019-10-22 modified: 2022-11-03 tags: - attack.impact - attack.stealth - attack.t1070 - attack.t1490 logsource: category: process_creation product: windows detection: selection1_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \wmic.exe - \vssadmin.exe - \diskshadow.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - wmic.exe - VSSADMIN.EXE - diskshadow.exe selection1_cli: CommandLine|contains|all: - shadow - delete selection2_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection2_cli: CommandLine|contains|all: - delete - catalog - quiet selection3_img: - Image|endswith: \vssadmin.exe - OriginalFileName: VSSADMIN.EXE selection3_cli: CommandLine|contains|all: - resize - shadowstorage CommandLine|contains: - unbounded - /MaxSize= condition: (all of selection1*) or (all of selection2*) or (all of selection3*) falsepositives: - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason - LANDesk LDClient Ivanti-PSModule (PS EncodedCommand) level: high