setupugc.exe

By first setting a command to a specific registry under `Setup-Unattend-Settings`, e.g. via: `reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Setup-Unattend-Settings\RunSynchronous\1" /v Path /d "{CMD}" /f`, executing the following will cause it to execute the command.

Use Execute binary through legitimate proxy

setupugc.exe specialize

Context

admin

Native

Execute

MITRE

T1218

Detection

IOC: `setupugc.exe` spawning child processes outside of Windows Setup context. Legitimate parents are `setuphost.exe` or `setup.exe`.

IOC: Registry writes to `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Setup-Unattend-Settings\RunSynchronous\` on a deployed system.

Refs

strontic.github.io/xcyclopedia/library/setupugc.exe-3CFE082E8656AD66B5B9FFEB28CF4EC3.html

lolbas-project.github.io/lolbas/Binaries/setupugc/

Same technique as above, but using the `auditUser` command-line option.

Use Execute binary through legitimate proxy

setupugc.exe auditUser

Context

admin

Native

Execute

MITRE

T1218

Detection

IOC: `setupugc.exe` spawning child processes outside of Windows Setup context. Legitimate parents are `setuphost.exe` or `setup.exe`.

IOC: Registry writes to `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Setup-Unattend-Settings\RunSynchronous\` on a deployed system.

Refs

strontic.github.io/xcyclopedia/library/setupugc.exe-3CFE082E8656AD66B5B9FFEB28CF4EC3.html

lolbas-project.github.io/lolbas/Binaries/setupugc/