SettingSyncHost.exe Used for Binary Hijacking
Detects the use of SettingSyncHost.exe to execute a hijacked binary. This technique leverages the legitimate Windows utility SettingSyncHost.exe, which is designed to synchronize settings across devices, to execute arbitrary commands. The rule specifically looks for instances where SettingSyncHost.exe's parent command line contains 'cmd.exe /c', 'RoamDiag.cmd', and '-outputpath', indicating an attempt to run a command-line interpreter to execute a script, while the image itself is not located in standard system directories, suggesting a hijacked execution.
Sigma
