Renamed Msdt.EXE Execution

Title: Renamed Msdt.EXE Execution
Status: test
Description:Detects the execution of a renamed "Msdt.exe" binary
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Msdt/
Author: pH-T (Nextron Systems)
Date: 2022-06-03
modified:2023-02-03
Tags:

• -'attack.stealth'
• -'attack.t1036.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    OriginalFileName: 'msdt.exe'
  filter:
    Image|endswith: '\msdt.exe'
  condition:selection and not filter
Falsepositives:
  -Unlikely
Level: high