Setup16.EXE Execution With Custom .Lst File

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

Known false positives

On modern Windows system, the "Setup16" utility is practically never used, hence false positive should be very rare.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1574.005` Hijack Execution Flow: Executable Installer File Permissions Weakness
Stealth	`T1574.005` Hijack Execution Flow: Executable Installer File Permissions Weakness

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Setup16.EXE Execution With Custom .Lst File
id: 99c8be4f-3087-4f9f-9c24-8c7e257b442e
status: test
description: |
    Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file.
    These ".lst" file can contain references to external program that "Setup16.EXE" will execute.
    Attackers and adversaries might leverage this as a living of the land utility.
references:
    - https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/
author: frack113
date: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage: 'C:\Windows\SysWOW64\setup16.exe'
        ParentCommandLine|contains: ' -m '
    filter_optional_valid_path:
        Image|startswith: 'C:\~MSSETUP.T\'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - On modern Windows system, the "Setup16" utility is practically never used, hence false positive should be very rare.
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    ParentImage: 'C:\Windows\SysWOW64\setup16.exe'
    ParentCommandLine|contains: ' -m '

Stage 2: `not filter_optional_valid_path`

filter_optional_valid_path:
    Image|startswith: 'C:\~MSSETUP.T\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	starts_with	`C:\~MSSETUP.T\`	`excludes:Image` `field:"Image" value:"C:\~MSSETUP.T\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ParentCommandLine`	match	`-m`	`field:"ParentCommandLine" kind:match value:" -m "`
`ParentImage`	eq	`C:\Windows\SysWOW64\setup16.exe`	`field:"ParentImage" kind:eq value:"C:\Windows\SysWOW64\setup16.exe"`