Title:Arbitrary Shell Command Execution Via Settingcontent-Ms Status:test Description:The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries. References: -https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39 Author: Sreeman Date: 2020-03-13 modified:2022-04-14 Tags:
-'attack.t1204'
-'attack.t1566.001'
-'attack.execution'
-'attack.initial-access'
Logsource:
category: process_creation
product: windows
Detection: selection: CommandLine|contains:
'.SettingContent-ms' filter: CommandLine|contains:
'immersivecontrolpanel' condition:selection and not filter Falsepositives:
-Unknown Level:medium
