Detection: Windows Execute Arbitrary Commands with MSDT

Date: 2022-09-15 ID: f253f9c2-10f0-4cc8-b469-f505ba8c2038 Author: Michael Haag, Splunk Type: TTP Product: Splunk User Behavior Analytics

Description

The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product.

Annotations

No annotations available.

Implementation

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Known False Positives

False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
$process_name$ on $dest_device_id$ under user $dest_user_id$ possibly indicative of indirect command execution. 100 100 100
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Version: 4