From 32643efae4527f4c498bd135dc707b40c6af3265 Mon Sep 17 00:00:00 2001 From: Ashish Pulivarthy Date: Thu, 6 Aug 2026 19:14:27 +0530 Subject: [PATCH 1/3] Add SystemSettingsAdminFlows.exe --- yml/OSBinaries/SystemSettingsAdminFlows.yml | 51 +++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 yml/OSBinaries/SystemSettingsAdminFlows.yml diff --git a/yml/OSBinaries/SystemSettingsAdminFlows.yml b/yml/OSBinaries/SystemSettingsAdminFlows.yml new file mode 100644 index 00000000..e3773081 --- /dev/null +++ b/yml/OSBinaries/SystemSettingsAdminFlows.yml @@ -0,0 +1,51 @@ +--- +Name: SystemSettingsAdminFlows.exe +Description: Windows Settings administrative flows utility, used by the Settings app to apply system configuration changes that require elevation +Author: Ashish Pulivarthy +Created: 2026-08-06 +Commands: + - Command: SystemSettingsAdminFlows.exe Defender RTP 1 + Description: Disables Microsoft Defender Real-Time Protection + Usecase: Disable endpoint protection prior to deploying additional tooling or ransomware + Category: Tamper + Privileges: Admin + MitreID: T1562.001 + OperatingSystem: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022 + - Command: SystemSettingsAdminFlows.exe Defender SpynetReporting 0 + Description: Disables Microsoft Defender cloud-delivered protection (MAPS/SpyNet reporting) + Usecase: Reduce detection efficacy by severing cloud-based protection + Category: Tamper + Privileges: Admin + MitreID: T1562.001 + OperatingSystem: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022 + - Command: SystemSettingsAdminFlows.exe Defender SubmitSamplesConsent 0 + Description: Disables automatic sample submission to Microsoft + Usecase: Prevent suspicious files from being submitted for analysis + Category: Tamper + Privileges: Admin + MitreID: T1562.001 + OperatingSystem: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022 + - Command: SystemSettingsAdminFlows.exe Defender DisableEnhancedNotifications 1 + Description: Disables Microsoft Defender enhanced notifications + Usecase: Suppress alerts that would otherwise surface malicious activity to the user + Category: Tamper + Privileges: Admin + MitreID: T1562.001 + OperatingSystem: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022 +Full_Path: + - Path: C:\Windows\System32\SystemSettingsAdminFlows.exe +Code_Sample: + - Code: +Detection: + - IOC: SystemSettingsAdminFlows.exe executed with a "Defender" argument + - IOC: SystemSettingsAdminFlows.exe with a parent process other than SystemSettings.exe or the Settings app + - IOC: Microsoft-Windows-Windows Defender/Operational Event ID 5007 recording a configuration change + - IOC: Sysmon Event ID 1 / Security Event ID 4688 process creation for SystemSettingsAdminFlows.exe + - Analysis: https://www.huntress.com/blog/lolbin-to-inc-ransomware + - Sigma: https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_systemsettingsadminflows_defender_disable/ +Resources: + - Link: https://www.huntress.com/blog/lolbin-to-inc-ransomware + - Link: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ +Acknowledgement: + - Person: Harlan Carvey + Handle: '@keydet89' From 2c03f2dc5948580e1185a0d9b68769c23f84cdd5 Mon Sep 17 00:00:00 2001 From: Ashish Pulivarthy Date: Thu, 6 Aug 2026 19:29:11 +0530 Subject: [PATCH 2/3] Remove Code_Sample section from YAML file Removed Code_Sample section from SystemSettingsAdminFlows.yml. --- yml/OSBinaries/SystemSettingsAdminFlows.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/yml/OSBinaries/SystemSettingsAdminFlows.yml b/yml/OSBinaries/SystemSettingsAdminFlows.yml index e3773081..90ba849e 100644 --- a/yml/OSBinaries/SystemSettingsAdminFlows.yml +++ b/yml/OSBinaries/SystemSettingsAdminFlows.yml @@ -34,8 +34,6 @@ Commands: OperatingSystem: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022 Full_Path: - Path: C:\Windows\System32\SystemSettingsAdminFlows.exe -Code_Sample: - - Code: Detection: - IOC: SystemSettingsAdminFlows.exe executed with a "Defender" argument - IOC: SystemSettingsAdminFlows.exe with a parent process other than SystemSettings.exe or the Settings app From 7e9e622107908fbf84086eadf5e41577393e915d Mon Sep 17 00:00:00 2001 From: Ashish Pulivarthy Date: Thu, 6 Aug 2026 19:35:27 +0530 Subject: [PATCH 3/3] Revise detection and analysis links in YAML file Updated detection rules and analysis links for SystemSettingsAdminFlows. --- yml/OSBinaries/SystemSettingsAdminFlows.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/yml/OSBinaries/SystemSettingsAdminFlows.yml b/yml/OSBinaries/SystemSettingsAdminFlows.yml index 90ba849e..a7f8597f 100644 --- a/yml/OSBinaries/SystemSettingsAdminFlows.yml +++ b/yml/OSBinaries/SystemSettingsAdminFlows.yml @@ -35,12 +35,12 @@ Commands: Full_Path: - Path: C:\Windows\System32\SystemSettingsAdminFlows.exe Detection: + - Sigma: https://github.com/SigmaHQ/sigma/blob/8eaafff1f2845a696050e05e72ba1140ee190698/rules/windows/process_creation/proc_creation_win_systemsettingsadminflows_defender_disable.yml + - Analysis: https://www.huntress.com/blog/lolbin-to-inc-ransomware - IOC: SystemSettingsAdminFlows.exe executed with a "Defender" argument - IOC: SystemSettingsAdminFlows.exe with a parent process other than SystemSettings.exe or the Settings app - IOC: Microsoft-Windows-Windows Defender/Operational Event ID 5007 recording a configuration change - IOC: Sysmon Event ID 1 / Security Event ID 4688 process creation for SystemSettingsAdminFlows.exe - - Analysis: https://www.huntress.com/blog/lolbin-to-inc-ransomware - - Sigma: https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_systemsettingsadminflows_defender_disable/ Resources: - Link: https://www.huntress.com/blog/lolbin-to-inc-ransomware - Link: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/