LOLBAS/yml/OSBinaries/Setres.yml
frack113 1072d3dc34
Add sigma ref Detection (#272)
* Add sigma ref

* Add missing sigma ref

* Fix sigma link

* Remove by Defender

* Remove by Defender
2022-12-29 09:51:15 -05:00

26 lines
953 B
YAML

---
Name: Setres.exe
Description: Configures display settings
Author: Grzegorz Tworek
Created: 2022-10-21
Commands:
- Command: setres.exe -w 800 -h 600
Description: Sets the resolution and then launches 'choice' command from the working directory.
Usecase: Executes arbitrary code
Category: Execute
Privileges: User
MitreID: T1218
OperatingSystem: Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
Full_Path:
- Path: c:\windows\system32\setres.exe
Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_setres.yml
- IOC: Unusual location for choice.exe file
- IOC: Process created from choice.com binary
- IOC: Existence of choice.cmd file
Resources:
- Link: https://twitter.com/0gtweet/status/1583356502340870144
Acknowledgement:
- Person: Grzegorz Tworek
Handle: '@0gtweet'