Sigma rule: Setup16.EXE Execution With Custom .Lst File

Rule

Title

Setup16.EXE Execution With Custom .Lst File

Status

test

Level

medium

Author

frack113

Date

2024-12-01

File

rules/windows/process_creation/proc_creation_win_setup16_custom_lst_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file.
These ".lst" file can contain references to external program that "Setup16.EXE" will execute.
Attackers and adversaries might leverage this as a living of the land utility.

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage: 'C:\Windows\SysWOW64\setup16.exe'
    ParentCommandLine|contains: ' -m '
filter_optional_valid_path:
    Image|startswith: 'C:\~MSSETUP.T\'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• On modern Windows system, the "Setup16" utility is practically never used, hence false positive should be very rare.

Tags

• attack.privilege-escalation
• attack.persistence
• attack.execution
• attack.stealth
• attack.t1574.005

MITRE ATT&CK ids this rule names

• T1574.005

References

• https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_setup16_custom_lst_execution.yml