Windows Process Execution of .SettingContent-ms Command Line

title: Windows Process Execution of .SettingContent-ms Command Line
id: 7663613e-f90b-4926-ad91-a33ff2f42f28
status: test
description: This rule identifies Windows process creation events where the command line contains the string '.SettingContent-ms'. This file type can be used to redirect execution to Windows setting components, making it a practical mechanism for attackers to trigger arbitrary command execution paths through Windows binaries. Detection relies on process creation telemetry that includes the full command line and uses an exclusion to reduce matches associated with 'immersivecontrolpanel'.
references:
  - https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.yml
author: Sreeman, Huntrule Team
date: 2020-03-13
modified: 2022-04-14
tags:
  - attack.t1204
  - attack.t1566.001
  - attack.execution
  - attack.initial-access
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: .SettingContent-ms
  filter:
    CommandLine|contains: immersivecontrolpanel
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 24de4f3b-804c-4165-b442-5a06a2302c7e
    type: derived