Windows: SettingSyncHost.exe executing RoamDiag.cmd via cmd.exe /c -outputpath

title: "Windows: SettingSyncHost.exe executing RoamDiag.cmd via cmd.exe /c -outputpath"
id: 881e7040-ae74-43e6-bd87-a7f807f964e1
status: test
description: This rule identifies process executions where SettingSyncHost.exe is the parent for a command line that includes cmd.exe /c, RoamDiag.cmd, and -outputpath. It also excludes cases where the child process image is located under standard Windows System32 or SysWOW64 paths. Attackers may abuse SettingSyncHost.exe as a trusted execution path to run a hijacked or unintended binary, so unexpected parent-child command line combinations matter for persistence and stealth. The detection relies on Windows process creation telemetry, specifically parent command line content and the child process image path.
references:
  - https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_settingsynchost.yml
author: Anton Kutepov, oscd.community, Huntrule Team
date: 2020-02-05
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.008
logsource:
  category: process_creation
  product: windows
detection:
  system_utility:
    Image|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
  parent_is_settingsynchost:
    ParentCommandLine|contains|all:
      - cmd.exe /c
      - RoamDiag.cmd
      - -outputpath
  condition: not system_utility and parent_is_settingsynchost
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b2ddd389-f676-4ac4-845a-e00781a48e5f
    type: derived