Windows Setup16.EXE Execution Triggered by Custom .LST File
Flags Windows Setup16.EXE being invoked with ' -m ' from its system parent process, potentially tied to custom .lst-driven execution.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2024-12-01
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of Setup16.EXE when it is launched with a command line containing the parameter pattern ' -m ', under the specific parent process path C:\Windows\SysWOW64\setup16.exe. It focuses on cases where Setup16 can be invoked with an external .lst file that may direct additional program execution, which can be abused for stealthy utility execution. The detection relies on process creation telemetry, including the parent image and parent command line. It also excludes executions originating from C:\~MSSETUP.T\ to reduce noise.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Setup16.EXE Execution Triggered by Custom .LST File
id: 73bfa15e-cdc2-4a50-a238-c3b7e42b710a
status: test
description: This rule identifies execution of Setup16.EXE when it is launched with a command line containing the parameter pattern ' -m ', under the specific parent process path C:\Windows\SysWOW64\setup16.exe. It focuses on cases where Setup16 can be invoked with an external .lst file that may direct additional program execution, which can be abused for stealthy utility execution. The detection relies on process creation telemetry, including the parent image and parent command line. It also excludes executions originating from C:\~MSSETUP.T\ to reduce noise.
references:
- https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_setup16_custom_lst_execution.yml
author: frack113, Huntrule Team
date: 2024-12-01
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574.005
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage: C:\Windows\SysWOW64\setup16.exe
ParentCommandLine|contains: " -m "
filter_optional_valid_path:
Image|startswith: C:\~MSSETUP.T\
condition: selection and not 1 of filter_optional_*
falsepositives:
- On modern Windows system, the "Setup16" utility is practically never used, hence false positive should be very rare.
level: medium
license: DRL-1.1
related:
- id: 99c8be4f-3087-4f9f-9c24-8c7e257b442e
type: derived