Windows Setup16.EXE Execution Triggered by Custom .LST File

title: Windows Setup16.EXE Execution Triggered by Custom .LST File
id: 73bfa15e-cdc2-4a50-a238-c3b7e42b710a
status: test
description: This rule identifies execution of Setup16.EXE when it is launched with a command line containing the parameter pattern ' -m ', under the specific parent process path C:\Windows\SysWOW64\setup16.exe. It focuses on cases where Setup16 can be invoked with an external .lst file that may direct additional program execution, which can be abused for stealthy utility execution. The detection relies on process creation telemetry, including the parent image and parent command line. It also excludes executions originating from C:\~MSSETUP.T\ to reduce noise.
references:
  - https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_setup16_custom_lst_execution.yml
author: frack113, Huntrule Team
date: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage: C:\Windows\SysWOW64\setup16.exe
    ParentCommandLine|contains: " -m "
  filter_optional_valid_path:
    Image|startswith: C:\~MSSETUP.T\
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - On modern Windows system, the "Setup16" utility is practically never used, hence false positive should be very rare.
level: medium
license: DRL-1.1
related:
  - id: 99c8be4f-3087-4f9f-9c24-8c7e257b442e
    type: derived