Rule Info
Name
Setup16.EXE Execution With Custom .Lst File
Author
frack113
Description
Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file.
These ".lst" file can contain references to external program that "Setup16.EXE" will execute.
Attackers and adversaries might leverage this as a living of the land utility.
Reference
Date
2024-12-01 00:00:00
Modified
None
Id
99c8be4f-3087-4f9f-9c24-8c7e257b442e
Tags
attack.defense-evasion attack.t1574.005
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
frack113
Merge PR #5046 from @frack113 - Add `Setup16.EXE Execution With Custom .Lst File`
2024-12-01
Scan your endpoints, forensic images or collected files with our portable scanner THOR