Setres.exe — LOLBAS

Execute

ExecutionWindows

Sets the resolution and then launches 'choice' command from the working directory.

Use Executes arbitrary code

setres.exe -w 800 -h 600

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_setres.yml
IOC: Unusual location for choice.exe file
IOC: Process created from choice.com binary
IOC: Existence of choice.cmd file
Refs: twitter.com/0gtweet/status/1583356502340870144
lolbas-project.github.io/lolbas/Binaries/Setres/