Windows Terminal settings.json modified by uncommon process
Alerts on Windows Terminal settings.json changes made by an uncommon command-line or script host process.
- Product
- windows
- Category
- file_event
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-22
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file creation or modification of the Windows Terminal user settings file (settings.json) when the writing process is not among common shell/script interpreters. Attackers may use changes to Windows Terminal profile settings to persist or stage activity under a user context. It relies on Windows file event telemetry capturing the process image and the target settings.json path under the WindowsTerminal package directory.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1547.015/T1547.015.md#atomic-test-1---persistence-by-modifying-windows-terminal-profile
- twitter.comhttps://twitter.com/nas_bench/status/1550836225652686848
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_windows_terminal_profile.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Terminal settings.json modified by uncommon process
id: 831cd67a-7419-4f3c-b1f6-d4e7eade31a9
status: test
description: This rule flags file creation or modification of the Windows Terminal user settings file (settings.json) when the writing process is not among common shell/script interpreters. Attackers may use changes to Windows Terminal profile settings to persist or stage activity under a user context. It relies on Windows file event telemetry capturing the process image and the target settings.json path under the WindowsTerminal package directory.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1547.015/T1547.015.md#atomic-test-1---persistence-by-modifying-windows-terminal-profile
- https://twitter.com/nas_bench/status/1550836225652686848
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_windows_terminal_profile.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-22
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.015
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith:
- \cmd.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
TargetFilename|endswith: \AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json
condition: selection
falsepositives:
- Some false positives may occur with admin scripts that set WT settings.
level: medium
license: DRL-1.1
related:
- id: 9b64de98-9db3-4033-bd7a-f51430105f00
type: derived