setupugc.exe

By first setting a command to a specific registry under `Setup-Unattend-Settings`, e.g. via: `reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Setup-Unattend-Settings\RunSynchronous\1" /v Path /d "{CMD}" /f`, executing the following will cause it to execute the command.

Use Execute binary through legitimate proxy

setupugc.exe specialize

Evidence

Upstream reference

Environment

Local host

Context

admin

Native

Execute

MITRE

T1218

Detection

IOC: `setupugc.exe` spawning child processes outside of Windows Setup context. Legitimate parents are `setuphost.exe` or `setup.exe`.

IOC: Registry writes to `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Setup-Unattend-Settings\RunSynchronous\` on a deployed system.

Refs

strontic.github.io/xcyclopedia/library/setupugc.exe-3CFE082E8656AD66B5B9FFEB28CF4EC3.html

lolbas-project.github.io/lolbas/Binaries/setupugc/

Same technique as above, but using the `auditUser` command-line option.

Use Execute binary through legitimate proxy

setupugc.exe auditUser

Evidence

Upstream reference

Environment

Local host

Context

admin

Native

Execute

MITRE

T1218

Detection

IOC: `setupugc.exe` spawning child processes outside of Windows Setup context. Legitimate parents are `setuphost.exe` or `setup.exe`.

IOC: Registry writes to `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Setup-Unattend-Settings\RunSynchronous\` on a deployed system.

Refs

strontic.github.io/xcyclopedia/library/setupugc.exe-3CFE082E8656AD66B5B9FFEB28CF4EC3.html

lolbas-project.github.io/lolbas/Binaries/setupugc/