Identifier / Programs / Windows
msdt.exe
Invokes a troubleshooting pack at the command line or as part of an automated script, and enables additional options without user input. Windows commands reference
LOLBAS Execute, AWL Bypass 8 Sigma rules name it 4 ATT&CK techniques 3 documented commands 12 known copies with hashes
How msdt.exe is abused
Execute T1218 System Binary Proxy Execution
/path.diagpkg file .diagcfg file> Specifies the full path to a diagnostic package. Windows commands reference/afSpecifies an answer file in XML format that contains responses to one or more diagnostic interactions. Windows commands reference-skipAWL Bypass T1218 System Binary Proxy Execution
/path.diagpkg file .diagcfg file> Specifies the full path to a diagnostic package. Windows commands reference/afSpecifies an answer file in XML format that contains responses to one or more diagnostic interactions. Windows commands reference-skipAWL Bypass T1202 Indirect Command Execution
/idSpecifies which diagnostic package to run. Windows commands reference-skip/paramSpecifies a set of interaction responses at the command line, similar to an answer file. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for msdt.exe.
3 documented commands
Execute T1218 System Binary Proxy Execution User privileges
Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file.
msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUETrips no Sigma process-creation rule.
AWL Bypass T1218 System Binary Proxy Execution User privileges
Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the .xml file.
msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUETrips no Sigma process-creation rule.
AWL Bypass T1202 Indirect Command Execution User privileges
Executes arbitrary commands using the Microsoft Diagnostics Tool and leveraging the "PCWDiagnostic" module (CVE-2022-30190). Note that this specific technique will not work on a patched system with the June 2022 Windows Security update.
msdt.exe /id PCWDiagnostic /skip force /param "IT_LaunchMethod=ContextMenu IT_BrowseForFile=/../../$(calc).exe"Trips 1 Sigma rule: highPotential Arbitrary Command Execution Using Msdt.EXE by Nasreddine Bencherchali (Nextron Systems)
1 of the 3 commands the identifier reads trips a Sigma process-creation rule; 2 trip none. These commands and their descriptions are from LOLBAS’s entry for msdt.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for msdt.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real msdt.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msdt.exe · signed by Microsoft Windows
ae98210a080c9f124ac7224b719773b11f70e48404ae394e3f7311a06532eb8110.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\msdt.exe · signed by Microsoft Windows
f2367a8459fcaefb36d55c1b5f90963cb68ac8489589767010412beabe3bf03f10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msdt.exe · signed by Microsoft Windows
48103c8ee52d4ceff0fb8974ffb17e6bfab773b51f9d187a3a581401d6a7663b10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\msdt.exe · signed by Microsoft Windows
6859d1b5d1beaa2985b298f3fcee67f0aac747687a9dec2b4376585e99e9756f10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\msdt.exe · signed by Microsoft Windows
30cca92b58621615572f1c9f37f3c6ae4dd6fe54f0bfc372a664fc5c554aa1e510.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msdt.exe · signed by Microsoft Windows
a4cbe4f41263b833294d2749de34fc588ca44d9bc5e3a78bbdce515250c220c610.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msdt.exe · signed by Microsoft Windows
1be8afd2962596807611e6a8836952d6bbdc24bde52a34905006ff78f1ad5d1210.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\msdt.exe · signed by Microsoft Windows
7253695fed91c65571bf59a7c61f1f1c72a081ca6ef687043cb039c7b35ca62310.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\msdt.exe · signed by Microsoft Windows
3e725546d8df09b6658d851f44a56a07f668f7ab14fff1130e5e98e384f2ce6710.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\msdt.exe · signed by Microsoft Windows
c1237bdd2b574c1cbbb4a0d990773bbed5b6fe3bd14f8011c0e79f9cddca2b4e6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\msdt.exe · not signed
c44e5453e9d5f6ff38f5f7493d74d7f7aa0354ec8f1d761963d3ce93c49cf1ac6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\msdt.exe · not signed
f7d246347fa82ef329f23adf5583c1f1867d7ae422be94f8f5f1e7c0e52f78e1From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Options
Show every option of msdt.exe
/idSpecifies which diagnostic package to run./path.diagpkg file .diagcfg file> Specifies the full path to a diagnostic package./dciPrepopulates the passkey field./dtDisplays the troubleshooting history in the specified directory./afSpecifies an answer file in XML format that contains responses to one or more diagnostic interactions./modalMakes the troubleshooting pack modal to a window designated by the parent Console Window Handle (HWND), in decimal./moreoptionsfalse> Enables (true) or suppresses (false) the final troubleshooting screen that asks if the user wants to explore additional options./paramSpecifies a set of interaction responses at the command line, similar to an answer file./advancedExpands the advanced link on the Welcome page by default when the troubleshooting pack is started./customPrompts the user to confirm each possible resolution before it's applied.