Create proc_creation_win_msdt.yml

rules/windows/process_creation/proc_creation_win_msdt.yml

@@ -0,0 +1,26 @@
+title: Execute Arbitrary Commands Using MSDT.EXE
+id: 258fc8ce-8352-443a-9120-8a11e4857fa5
+status: experimental
+description: Detects word documents leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands
+author: Nasreddine Bencherchali (rule)
+references:
+  - https://twitter.com/nao_sec/status/1530196847679401984
+  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+date: 2022/05/29
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection_parent:
+    ParentImage|endswith: '\WINWORD.exe'
+    Image|endswith: '\msdt.exe'
+  selection_cmd:
+    Image|endswith: '\msdt.exe'
+    CommandLine|contains|all:
+      - 'ms-msdt:/id'
+      - 'IT_BrowseForFile='
+      - 'IT_RebrowseForFile='
+  condition: 1 of selection*
+falsepositives:
+  - Unknown
+level: high