LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

setupugc.exe

View source

Setup Unattend Generic Command Processor used during Windows deployment.

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1218

By first setting a command to a specific registry under `Setup-Unattend-Settings`, e.g. via: `reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Setup-Unattend-Settings\RunSynchronous\1" /v Path /d "{CMD}" /f`, executing the following will cause it to execute the command.

COMMAND
setupugc.exe specialize
USE CASE
Execute binary through legitimate proxy
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10, Windows 11, Windows Server 2025
Execute · CMDRequires · Registry Change
EXAMPLE 02T1218

Same technique as above, but using the `auditUser` command-line option.

COMMAND
setupugc.exe auditUser
USE CASE
Execute binary through legitimate proxy
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10, Windows 11, Windows Server 2025
Execute · CMDRequires · Registry Change
02 / ON DISK

Known paths

C:\Windows\System32\setupugc.exe
C:\Windows\SysWOW64\setupugc.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

Indicators & detection notes

  • IOC

    `setupugc.exe` spawning child processes outside of Windows Setup context. Legitimate parents are `setuphost.exe` or `setup.exe`.

  • IOC

    Registry writes to `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Setup-Unattend-Settings\RunSynchronous\` on a deployed system.

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Ang Kar Min@karminang