Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Arbitrary Shell Command Execution Via Settingcontent-Ms

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
SreemanCreated Fri Mar 13Updated Thu Apr 1424de4f3b-804c-4165-b442-5a06a2302c7ewindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection:
        CommandLine|contains: '.SettingContent-ms'
    filter:
        CommandLine|contains: 'immersivecontrolpanel'
    condition: selection and not filter
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
posts.specterops.io
MITRE ATT&CK
Rule Metadata
Rule ID
24de4f3b-804c-4165-b442-5a06a2302c7e
Status
test
Level
medium
Type
Detection
Created
Fri Mar 13
Modified
Thu Apr 14
Author
Sreeman
Path
rules/windows/process_creation/proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.yml
Raw Tags
attack.t1204attack.t1566.001attack.executionattack.initial-access
View on GitHub