Setres.exe

Commands

1. ExecuteUser T1218

   Executes arbitrary code

   setres.exe -w 800 -h 600

   Sets the resolution and then launches ‘choice’ command from the working directory.

   os: Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022

   Execute: EXE

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_setres.yml
• IOCUnusual location for choice.exe file
• IOCProcess created from choice.com binary
• IOCExistence of choice.cmd file

Resources

• https://twitter.com/0gtweet/status/1583356502340870144