Msconfig.exe — LOLBAS

Execute

ExecutionWindows

Executes command embeded in crafted c:\windows\system32\mscfgtlc.xml.

Use Code execution using Msconfig.exe

Msconfig.exe -5

Evidence: Upstream reference
Environment: Local host
Context: admin
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_uac_bypass_msconfig_gui.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_msconfig_gui.yml
IOC: mscfgtlc.xml changes in system32 folder
Refs: twitter.com/pabraeken/status/991314564896690177
lolbas-project.github.io/lolbas/Binaries/Msconfig/