Windows Terminal Profile Settings Modification By Uncommon Process

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•24

Detects when an uncommon process modifies the Windows Terminal profile settings file, "settings.json". This activity can be indicative of persistence or privilege escalation attempts where an attacker modifies the terminal's startup behavior or injects malicious commands to be executed when the terminal is launched.