Arbitrary Shell Command Execution Via Settingcontent-Ms File

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects the execution of arbitrary shell commands via the '.SettingContent-ms' file type. These files, introduced in Windows 10, are XML-based shortcuts to Windows settings pages. Adversaries can manipulate these files to execute malicious commands, bypassing typical execution controls. The rule specifically looks for process creation events where the command line contains '.SettingContent-ms' and excludes legitimate calls to 'immersivecontrolpanel'.