public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-02-05 10:02:00 +01:00
Code Issues Projects Releases Wiki Activity

added fixes

Browse Source
This commit is contained in:
JasonPhang98 2025-01-19 17:54:46 +08:00
parent 7cba51c52d
commit c44c70d55b
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
yml/OSBinaries/SystemSettingsAdminFlow.yml
View File

@ -5,11 +5,10 @@ Author: 'Jason Phang Vern-Onn'
Created: 2025-01-19
Commands:
- Command: C:\Windows\System32\SystemSettingsFlowAdmin.exe Defender DisableEnhancedNotifications 1
- Command: C:\Windows\System32\SystemSettingsFlowAdmin.exe Defender SubmitSamplesConsent 0
- Command: C:\Windows\System32\SystemSettingsFlowAdmin.exe Defender SubmitSamplesConsent 0
- Command: C:\Windows\System32\SystemSettingsFlowAdmin.exe Defender SpynetReporting 0
- Command: C:\Windows\System32\SystemSettingsFlowAdmin.exe Defender RTP 1
Description: SystemSettingsFlowAdmin.exe can be abused to modify Windows Defender settings, such as disabling enhanced notifications, submission consent, and real-time protection.
This allows execution of potentially malicious software without detection.
- Command: C:\Windows\System32\SystemSettingsFlowAdmin.exe Defender RTP 1
Description: SystemSettingsFlowAdmin.exe can be abused to modify Windows Defender settings, such as disabling enhanced notifications, submission consent, and real-time protection. This allows execution of potentially malicious software without detection.
Usecase: Attackers can exploit this binary to disable critical Windows Defender settings and bypass security measures, enabling malware execution.
Category: Execute
Privileges: Administrator
@ -22,12 +21,12 @@ Full_Path:
- Path: C:\Windows\System32\SystemSettingsFlowAdmin.exe
- Path: C:\Windows\Syswow64\SystemSettingsFlowAdmin.exe
Detection:
- IOC: Microsoft-Windows-Windows Defender/Operational Event Log Event ID 5007 for changes.
- IOC: SystemSettingsFlowAdmin.exe spawned with parent image not SystemSettings.exe.
- IOC: Microsoft-Windows-Windows Defender/Operational Event Log Event ID 5007 for changes
- IOC: SystemSettingsFlowAdmin.exe spawned with parent image not SystemSettings.exe
- Sigma: https://gist.githubusercontent.com/ald3n5/b1a3f4138b1a1624f7e183a3d0859d17/raw/29e6f67fa3920a39cb4c4bc5226f21a6057fa5ad/susp_adminflows_tampering_defender.yml
Resources:
- Link: https://www.huntress.com/blog/lolbin-to-inc-ransomware
- Link: https://www.huntress.com/blog/its-not-safe-to-pay-safepay
Acknowledgement:
- Person: Alden Schmidt
- Person: Matt Anderson
- Person: Matt Anderson