The first step is to contain execution paths that enable the exploit and look for evidence of prior abuse. Disable Troubleshooting Wizards through policy, remove the ms-msdt URL protocol if appropriate, then hunt for process creation involving msdt.exe and diagnostic command-line patterns. Because the vulnerability was observed in the wild, response should include validation across email, file delivery, and endpoint telemetry.
Why containment comes before broad hunting
When Follina-style ms-msdt abuse is suspected, the immediate objective is to stop the execution path that the payload relies on. That means treating the endpoint as potentially already in an exploit chain, not as a simple configuration issue. The fastest useful action is to reduce the chance of repeat execution, then preserve enough telemetry to determine whether the abuse reached process creation, script execution, or follow-on payload delivery.
In practice, that usually means using policy to disable Troubleshooting Wizards and, where appropriate, removing the ms-msdt protocol handler. Those changes are valuable because they remove the trigger path rather than waiting for an alert after exploitation has already progressed.
What evidence matters on Windows endpoints
The most useful endpoint evidence is process creation around msdt.exe and the command-line patterns that indicate diagnostic tooling was invoked in a suspicious context. Security teams should correlate that with parent-child process relationships, document opens, and any signs that the exploit arrived through a file, preview pane, browser content, or email attachment.
Telemetry should not be limited to a single endpoint event source. A credible assessment needs to connect endpoint execution with mail gateway, file delivery, and host telemetry so responders can answer two questions: did execution occur, and if so, how far did the abuse progress before containment?
Because the abuse was observed in the wild, hunting should also include adjacent hosts that received the same message, document, or delivery chain. That is often the difference between isolating one impacted system and missing a broader campaign spread.
How to scope response without overcorrecting
The first response step is not full rebuild or blanket reimage unless the evidence shows secondary payloads, persistence, or lateral movement. Start with execution containment, validate whether msdt.exe or related diagnostic invocations occurred, and then decide whether the system needs deeper remediation based on the scope of observed activity.
That sequencing matters because Follina-style abuse is often about initial execution and payload staging. If teams move too quickly to cleanup without preserving the command-line and process tree evidence, they lose the ability to distinguish a blocked attempt from a successful compromise path.
Risk and Threat Considerations
This abuse path is risky because it converts ordinary document handling into code execution through a trusted Windows component. Once the trigger path is available, an attacker can use it to launch a payload, stage follow-on tools, or pivot into broader host compromise before defenders realise the document was malicious.
Failure mechanism: The exploit relies on a user or application path that causes msdt.exe to run with attacker-controlled diagnostic parameters, so the abuse can occur through content delivery channels that look routine until execution starts.
Impact: If the trigger is not contained quickly, defenders may face endpoint compromise, payload delivery, and broader incident scope across mail, download, and endpoint telemetry, especially when the same lure is delivered to multiple users.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | CM-7 — Least Functionality | Disabling ms-msdt reduces unnecessary execution paths on Windows endpoints. |
| SI-4 — System Monitoring | Hunting msdt.exe and command-line abuse depends on endpoint monitoring and alerting. | |
| Recommendation — Remove or disable the ms-msdt execution path and other unnecessary diagnostic features. Collect and review process-creation telemetry for msdt.exe and suspicious diagnostic command lines. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The response relies on retaining endpoint and delivery telemetry to validate abuse. |
| Recommendation — Centralize and preserve endpoint, mail, and file-delivery logs for incident scoping. | ||
Practitioner Guidance
What to prioritise: Contain the trigger path first, then validate whether process creation actually occurred. If you can block execution and preserve telemetry at the same time, do both before making larger cleanup decisions.
What to verify: Confirm that policy changes really prevent Troubleshooting Wizards or the ms-msdt handler from being used on the affected build set, and verify that your telemetry can show parent process, command line, and original delivery vector.
Decision rule: If msdt.exe execution is observed, treat the host as potentially abused, even if no obvious persistence is present. If only delivery evidence exists, broaden the hunt to similarly targeted users and adjacent hosts before declaring the event contained.
Practitioner takeaway: For this kind of exploit, the best first move is to stop repeat execution and preserve proof of abuse, because that gives you both containment and a defensible basis for scoping the incident.
Related resources from NHI Mgmt Group
- Why is the abuse of NHIs a priority for security teams?
- How should security teams reduce the risk of LOLBin abuse on Windows endpoints?
- What should security teams do first when malware is suspected on endpoints or servers?
- What should security teams do first when PHP CGI exposure is suspected on Windows servers?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
