LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Msconfig.exe

View source

MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Executes command embeded in crafted c:\windows\system32\mscfgtlc.xml.

COMMAND
Msconfig.exe -5
USE CASE
Code execution using Msconfig.exe
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Execute · CMD
02 / ON DISK

Known paths

C:\Windows\System32\msconfig.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    mscfgtlc.xml changes in system32 folder

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Pierre-Alexandre Braeken@pabraeken