title: MSDT Executed with Suspicious Parent
id: 7a74da6b-ea76-47db-92cc-874ad90df734
status: experimental
description: Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation
author: Nextron Systems
references:
  - https://twitter.com/nao_sec/status/1530196847679401984
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
date: 2022/06/01
modified: 2022/06/02
tags:
  - attack.defense_evasion
  - attack.t1036
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\wsl.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      # office apps are covered by other rules
  selection_msdt:
    - Image|endswith: '\msdt.exe'
    - OriginalFileName: 'msdt.exe'
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
