Windows Process Execution of .SettingContent-ms Command Line

Flags Windows processes whose command lines reference .SettingContent-ms, a potential trigger for setting-based execution.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Sreeman (SigmaHQ), DRL 1.1
Published: 2020-03-13
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1566.001Spearphishing Attachment
Execution
- T1204User Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process creation events where the command line contains the string '.SettingContent-ms'. This file type can be used to redirect execution to Windows setting components, making it a practical mechanism for attackers to trigger arbitrary command execution paths through Windows binaries. Detection relies on process creation telemetry that includes the full command line and uses an exclusion to reduce matches associated with 'immersivecontrolpanel'.

Reporting behind it

Related detections9 linkedT1566.001 — drag to rearrange

Malicious Edge Abuse for Payload Download via Console (via process_creation)

Suspicious mstsc Launch of RDP File From User Download or Temp Path (via process_creation)

Suspicious Regsvr32 Squiblydoo Remote Scriptlet Execution via Command Line (via process_creation)

Obfuscated Edge/Chrome Headless Feature Abuse for Payload Download (via process_creation)

Possible Mamba 2FA AiTM Phishing URL Pattern

Suspicious DLL Written to Explorer IconCache Path

Suspicious DNS Query to HTML Smuggling AiTM Phishing Domain

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

Malicious Equation Editor Child Process Execution via process_creation

Windows Process Execution of .SettingContent-ms Command Line

Pivot detection · T1566.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-of-settingcontent-ms-command-line-24de4f3b

title: Windows Process Execution of .SettingContent-ms Command Line
id: 7663613e-f90b-4926-ad91-a33ff2f42f28
status: test
description: This rule identifies Windows process creation events where the command line contains the string '.SettingContent-ms'. This file type can be used to redirect execution to Windows setting components, making it a practical mechanism for attackers to trigger arbitrary command execution paths through Windows binaries. Detection relies on process creation telemetry that includes the full command line and uses an exclusion to reduce matches associated with 'immersivecontrolpanel'.
references:
  - https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.yml
author: Sreeman, Huntrule Team
date: 2020-03-13
modified: 2022-04-14
tags:
  - attack.t1204
  - attack.t1566.001
  - attack.execution
  - attack.initial-access
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: .SettingContent-ms
  filter:
    CommandLine|contains: immersivecontrolpanel
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 24de4f3b-804c-4165-b442-5a06a2302c7e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL