File Creation In Suspicious Directory By Msdt.EXE

Title: File Creation In Suspicious Directory By Msdt.EXE
Status: test
Description:Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities
References:
  -https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd
  -https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
Author: Vadim Varganov, Florian Roth (Nextron Systems)
Date: 2022-08-24
modified:2023-02-23
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1547.001'
• -'cve.2022-30190'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    Image|endswith: '\msdt.exe'
    TargetFilename|contains:
      -'\Desktop\'
      -'\Start Menu\Programs\Startup\'
      -'C:\PerfLogs\'
      -'C:\ProgramData\'
      -'C:\Users\Public\'

  condition:selection
Falsepositives:
  -Unknown
Level: high