Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE

Title: Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
Status: test
Description:Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library
References:
  -https://www.securonix.com/blog/detecting-microsoft-msdt-dogwalk/
Author: Greg (rule)
Date: 2022-06-17
modified:2023-02-17
Tags:

• -'attack.stealth'
• -'attack.t1202'
• -'cve.2022-30190'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    Image|endswith: '\msdt.exe'
    ImageLoaded|endswith: '\sdiageng.dll'
  condition:selection
Falsepositives:
  -Unknown
Level: high