Suspicious Arbitrary Shell Command Execution Through Settingcontent-Ms (via process_creation)

title: Suspicious Arbitrary Shell Command Execution Through Settingcontent-Ms (via process_creation)
id: 202ba27b-36b7-527f-9e49-035410b7394d
status: stable
description: This rule detects the .SettingContent-ms file type was introduced in Windows 10 and enables a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
references:
    - https://attack.mitre.org/techniques/T1566/001/
    - https://attack.mitre.org/techniques/T1204/
    - https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
author: Huntrule Team
date: 2026-05-13
tags:
    - attack.t1204
    - attack.t1566.001
    - attack.execution
    - attack.initial-access
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: '.SettingContent-ms'
    filter:
        CommandLine|contains: 'immersivecontrolpanel'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium