Detection rules › Sigma

Arbitrary Shell Command Execution Via Settingcontent-Ms

Severity
medium
Author
Sreeman
Source
upstream

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1566.001 Phishing: Spearphishing Attachment
ExecutionT1204 User Execution

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection

CommandLine|contains: .SettingContent-ms

Stage 2: not filter

CommandLine|contains: immersivecontrolpanel

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • .SettingContent-ms
  • immersivecontrolpanel