Windows: Flag SettingSyncHost.exe used to execute RoamDiag.cmd from cmd.exe
Flags non-System32/SysWOW64 processes spawned by SettingSyncHost.exe running RoamDiag.cmd via cmd.exe /c -outputpath.
- Product
- windows
- Category
- process_creation
- Author
- Anton Kutepov, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-02-05
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies executions where SettingSyncHost.exe launches a command chain that includes cmd.exe /c and a specific RoamDiag.cmd invocation with -outputpath. It matters because this behavior can indicate abuse of a legitimate Windows utility to run an attacker-controlled or hijacked binary indirectly. The detection relies on process creation telemetry, specifically the parent process command line and the child process image path being outside standard system directories.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Flag SettingSyncHost.exe used to execute RoamDiag.cmd from cmd.exe"
id: 881e7040-ae74-43e6-bd87-a7f807f964e1
status: test
description: This rule identifies executions where SettingSyncHost.exe launches a command chain that includes cmd.exe /c and a specific RoamDiag.cmd invocation with -outputpath. It matters because this behavior can indicate abuse of a legitimate Windows utility to run an attacker-controlled or hijacked binary indirectly. The detection relies on process creation telemetry, specifically the parent process command line and the child process image path being outside standard system directories.
references:
- https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_settingsynchost.yml
author: Anton Kutepov, oscd.community, Huntrule Team
date: 2020-02-05
modified: 2021-11-27
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574.008
logsource:
category: process_creation
product: windows
detection:
system_utility:
Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
parent_is_settingsynchost:
ParentCommandLine|contains|all:
- cmd.exe /c
- RoamDiag.cmd
- -outputpath
condition: not system_utility and parent_is_settingsynchost
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: b2ddd389-f676-4ac4-845a-e00781a48e5f
type: derived