msdt.exe

Top Paths

• C:\Windows\System3299.07%
• C:\Windows\SysWOW640.93%

Top Hashes (SHA256)

• 4883375668f90736eb709f6522339d0cecede8409a714d40a9d41bd4d212800a34.11%
• a4cbe4f41263b833294d2749de34fc588ca44d9bc5e3a78bbdce515250c220c617.05%
• 18a70605f1dbe99d20cbfc2ffbffd71276c476ca367c07b8e9cfaef12f169c8414.73%
• a1a4b1fe4d8b0e1c3cb8072ad00051f1a7baab14e89171f3da158b7f90d442c07.49%
• 6859d1b5d1beaa2985b298f3fcee67f0aac747687a9dec2b4376585e99e9756f5.17%
• 7253695fed91c65571bf59a7c61f1f1c72a081ca6ef687043cb039c7b35ca6235.17%
• c44e5453e9d5f6ff38f5f7493d74d7f7aa0354ec8f1d761963d3ce93c49cf1ac3.36%
• c1237bdd2b574c1cbbb4a0d990773bbed5b6fe3bd14f8011c0e79f9cddca2b4e2.84%
• bd59b4362f8590c5009b28830ff11b339b37ff142fb873204368905a9c843a082.07%
• e14c3b1039f625fd216cf3bb5ace83a17c15ccd8f1027f2959aa20863382d9bd2.07%

Top Grandparents

• explorer.exe42.12%
• userinit.exe41.1%
• svchost.exe3.77%
• winlogon.exe2.74%
• services.exe2.4%
• chrome.exe2.05%
• WerFault.exe1.37%
• iexplore.exe1.03%
• RuntimeBroker.exe1.03%
• browser_broker.exe0.68%

Top Parents

• explorer.exe46.17%
• msdt.exe25.75%
• chrome.exe6.5%
• rundll32.exe6.5%
• iexplore.exe4.18%
• SecurityHealthService.exe2.55%
• sihost.exe2.09%
• dllhost.exe1.16%
• browser_broker.exe0.7%
• msedge.exe0.23%

Top Children

• msdt.exe85.38%
• rundll32.exe9.23%
• wermgr.exe5.38%

What does msdt.exe normally do?

Runs from C:\Windows\System32. Launches diagnostic packages for troubleshooting Windows issues (networking, audio, Windows Update, etc.). Interactive UI. Uncommon in most environments — most users never directly invoke it.

When is msdt.exe suspicious?

Launched by Office applications (winword.exe, excel.exe, outlook.exe) — classic Follina indicator. Command line containing ms-msdt: protocol handler. Command line containing encoded PowerShell or script content. Spawning cmd.exe, powershell.exe, or other shells. Network connections.

How do attackers abuse msdt.exe?

1. CVE-2022-30190 (FOLLINA): A malicious Office document contains an OLE object referencing an HTML file via ms-msdt: protocol. When opened, Word fetches the HTML, which invokes msdt.exe with crafted arguments that execute arbitrary PowerShell code. The attack works even with macros disabled because it exploits the protocol handler, not VBA. Zero-click exploitation possible via preview pane in Explorer. 2. PROTOCOL HANDLER ABUSE: The ms-msdt: protocol can be invoked from any application, not just Office. Attackers craft URLs that pass diagnostic package parameters containing embedded PowerShell commands. 3. DIAGNOSTIC PACKAGE ABUSE: Custom diagnostic packages (.diagpkg) can contain arbitrary scripts. Attackers create malicious packages that execute code when msdt.exe processes them. Follina was heavily exploited in the wild by Chinese APT groups (TA413), commodity malware, and used in phishing campaigns targeting Ukraine during the 2022 conflict. Microsoft eventually disabled the ms-msdt: protocol handler.

Detection guidance

HIGH-CONFIDENCE DETECTIONS: - msdt.exe spawned by any Office application (winword.exe, excel.exe, powerpnt.exe, outlook.exe) - msdt.exe command line containing encoded/obfuscated content - msdt.exe spawning cmd.exe, powershell.exe, or cscript.exe/wscript.exe - msdt.exe with IT_BrowseForFile parameter containing script code MEDIUM-CONFIDENCE: - Any msdt.exe execution (rare enough to alert in most environments) DATA SOURCES: Process creation with command line (Sysmon 1, Windows 4688), network connections (Sysmon 3)

False positive notes

Legitimate troubleshooter use via Settings > Troubleshoot. Some IT support workflows invoke msdt.exe for remote diagnostics. Microsoft has deprecated the ms-msdt: protocol handler in newer Windows versions.

MITRE ATT&CK techniques

References

• https://attack.mitre.org/techniques/T1218/
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190