title: Execute MSDT.EXE Using Diagcab File
id: 6545ce61-a1bd-4119-b9be-fcbee42c0cf3
status: experimental
description: Detects diagcab leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in CVE-2022-30190
author: GossiTheDog (rule), frack113 (sigma version)
references:
    - https://github.com/GossiTheDog/ThreatHunting/blob/master/AdvancedHuntingQueries/DogWalk-DiagCab
date: 2022/06/09
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\msdt.exe'
        - OriginalFileName: 'msdt.exe'
    selection_cmd:
        CommandLine|contains|all:
            - '/cab'
            - '.diagcab'
    condition: all of selection_*
falsepositives:
    - Legitimate usage of ".diagcab" files
level: high
tags:
    - attack.defense_evasion
    - attack.t1202
