2022-10-26 12:15:13 +02:00
|
|
|
---
|
|
|
|
|
Name: Setres.exe
|
|
|
|
|
Description: Configures display settings
|
|
|
|
|
Author: Grzegorz Tworek
|
|
|
|
|
Created: 2022-10-21
|
|
|
|
|
Commands:
|
|
|
|
|
- Command: setres.exe -w 800 -h 600
|
|
|
|
|
Description: Sets the resolution and then launches 'choice' command from the working directory.
|
|
|
|
|
Usecase: Executes arbitrary code
|
|
|
|
|
Category: Execute
|
|
|
|
|
Privileges: User
|
|
|
|
|
MitreID: T1218
|
|
|
|
|
OperatingSystem: Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
|
|
|
|
|
Full_Path:
|
|
|
|
|
- Path: c:\windows\system32\setres.exe
|
|
|
|
|
Detection:
|
2022-12-29 15:51:15 +01:00
|
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_setres.yml
|
2022-10-26 12:15:13 +02:00
|
|
|
- IOC: Unusual location for choice.exe file
|
|
|
|
|
- IOC: Process created from choice.com binary
|
|
|
|
|
- IOC: Existence of choice.cmd file
|
|
|
|
|
Resources:
|
|
|
|
|
- Link: https://twitter.com/0gtweet/status/1583356502340870144
|
|
|
|
|
Acknowledgement:
|
|
|
|
|
- Person: Grzegorz Tworek
|
|
|
|
|
Handle: '@0gtweet'
|
