msdt.exe

msdt.exe runs diagnostic troubleshooting packs, guided wizards that collect information and apply fixes for a category of problem. It is normally launched by Windows or the Get Help app, not by users directly. The genuine binary lives at C:\Windows\System32\msdt.exe. It accepts a troubleshooting pack and parameters, and historically could be reached through the ms-msdt: URL protocol, the path that made it exploitable from documents.

Legitimately, msdt appears when someone runs a Windows troubleshooter. Its parent and how it was invoked, interactively versus from a document or URL handler, are what give an instance meaning.

msdt.exe is best known for "Follina" (CVE-2022-30190), an exploitation path where a Word document referenced the ms-msdt: protocol and passed parameters that caused msdt to execute attacker PowerShell with no macro and no user prompt (T1203). The pattern to recognize is an Office application as msdt's parent, or msdt spawning a shell.

More generally msdt is a system-binary proxy (T1218): its diagnostic parameters can be abused to run external commands through a signed Microsoft process, a form of indirect command execution (T1202). Because msdt legitimately runs only when someone uses a troubleshooter, a msdt launched by a document, through a URL handler, or spawning a command shell is the case to pull apart.