Skip to content

Instantly share code, notes, and snippets.

@Shivammalaviya

Shivammalaviya/MSDT Suspicious Command Execution

Last active May 31, 2022 16:58
Show Gist options
  • Save Shivammalaviya/a548eb18206d0afda7e8b50bc9149b5c to your computer and use it in GitHub Desktop.
Save Shivammalaviya/a548eb18206d0afda7e8b50bc9149b5c to your computer and use it in GitHub Desktop.
Download ZIP
Raw
MSDT Suspicious Command Execution
DeviceProcessEvents
| where (FolderPath endswith @"\msdt.exe" and (ProcessCommandLine contains "IT_RebrowseForFile"
or ProcessCommandLine contains "IT_BrowseForFile"))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment