LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

SettingSyncHost.exe

View source

Host Process for Setting Synchronization

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1218

Execute file specified in %COMSPEC%

COMMAND
SettingSyncHost -LoadAndRunDiagScript {PATH:.exe}
USE CASE
Can be used to evade defensive countermeasures or to hide as a persistence mechanism
PRIVILEGES
User
OPERATING SYSTEM
Windows 8, Windows 8.1, Windows 10
Execute · EXE
EXAMPLE 02T1218

Execute a batch script in the background (no window ever pops up) which can be subverted to running arbitrary programs by setting the current working directory to %TMP% and creating files such as reg.bat/reg.exe in that directory thereby causing them to execute instead of the ones in C:\Windows\System32.

COMMAND
SettingSyncHost -LoadAndRunDiagScriptNoCab {PATH:.bat}
USE CASE
Can be used to evade defensive countermeasures or to hide as a persistence mechanism. Additionally, effectively act as a -WindowStyle Hidden option (as there is in PowerShell) for any arbitrary batch file.
PRIVILEGES
User
OPERATING SYSTEM
Windows 8, Windows 8.1, Windows 10
Execute · CMD
02 / ON DISK

Known paths

C:\Windows\System32\SettingSyncHost.exe
C:\Windows\SysWOW64\SettingSyncHost.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    SettingSyncHost.exe should not be run on a normal workstation

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Adam@hexacorn
Elliot Killick@elliotkillick