Suspicious MSDT Parent Process
Last updated on:
In this page
Rule name | Rule type | Log sources | MITRE ATT&CK tags | Severity |
Suspicious MSDT Parent Process | Standard | Windows | Defense Evasion: Masquerading (T1036); Defense Evasion: System Binary Proxy Execution (T1218) | Trouble |
About the rule
Rule Type
Standard
Rule Description
Microsoft Support Diagnostic Tool (MSDT) is a tool in Windows systems that allows tech support agents to analyze and troubleshoot issues remotely. The .msdt file is usually executed by Windows services like the Service Host, but it can be abused by attackers and executed by suspicious parent processes, as seen in the CVE-2022-30190/Follina exploitation. This rule detects such malicious executions of the .msdt file.
Severity
Trouble
Rule journey
Attack chain scenario
Initial Access → Privilege Escalation → Defense Evasion → Suspicious process execution
Impact
- Vulnerability exploitation
- Defense evasion
- Malicious process execution
Rule Requirement
Prerequisites
- Windows Event Viewer
Log in to a domain controller with domain admin credentials and open the Group Policy Management Console. Create or edit a Group Policy Object linked to the appropriate organizational unit. Enable auditing for process creation and process termination events, ensuring success events are logged. For enhanced process tracking enable the inclusion of command line information in process creation events. Finally, create a new registry key "Microsoft-Windows-Security-Auditing/Operational" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog".
- Sysmon
Install Sysmon from Microsoft Sysinternals and download the Sysmon configuration file that includes process creation monitoring. Add process creation events to the configuration file to capture all process creations. Finally, create a registry key "Microsoft-Windows-Sysmon/Operational" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog".
Criteria
Action1: actionname = "Process started" AND PARENTPROCESSNAME endswith "\cmd.exe,\cscript.exe,\mshta.exe,\powershell.exe,\pwsh.exe,\regsvr32.exe,\rundll32.exe,\schtasks.exe,\wmic.exe,\wscript.exe,\wsl.exe" AND (PROCESSNAME endswith "\msdt.exe" OR ORIGINALFILENAME = "msdt.exe") select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
MITRE ATT&CK
Defense Evasion: Masquerading (T1036); Defense Evasion: System Binary Proxy Execution (T1218)
Security Standards
Enabling this rule will help you meet the security standard's requirement listed below:
DE.AE-02: Potentially adverse events are analyzed to better understand associated activities.
When this rule is triggered, you're notified of the execution of the .msdt file by a suspicious parent process. This enables you to identify malicious process creations in the system and detect attempts of defense evasion in the network.
Author
Nextron Systems
Future actions
Known False Positives
This rule might be triggered when help desk or remote support tools invoke MSDT as part of diagnostics.
Next Steps
When this rule is triggered, the following measures can be implemented:
- Identification: Identify if the flagged event is a new incident or part of an existing incident.
- Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
- Response: Respond promptly by initiating an automated workflow to interrupt the network connections and cease the malicious process.
- System process audit: Continuously monitor system processes and file executions to detect suspicious process creations and malware executions.
Mitigation
Mitigation ID | Mitigation Name | Mitigation description |
M1042 | Remove native binaries that are redundant. | |
M1038 | Enforce application control to prevent execution of binaries. | |
M1050 | Block the execution of binaries to bypass application control using capabilities such as Attack Surface Reduction. | |
M1037 | Filter and scan network traffic in endpoint devices. | |
M1026 | Restrict permissions to execute binaries to privileged accounts or groups only. | |
M1021 | Restrict use of malicious websites, browser extensions, etc. | |
M1049 | Implement antivirus or antimalware scanning to isolate suspicious files. | |
M1047 | Audit and manage user accounts. | |
M1040 | Block the execution of malicious files with mismatching file signatures in endpoints. | |
M1045 | Configure policies that allow execution of signed scripts only. | |
M1022 | Restrict access to critical folders such as C:\Windows\System32. | |
M1018 | Enforce a distinct naming convention for user accounts. | |
M1017 | Train users on safe practices while dealing with email attachments and URLs. |
