title: Exploiting SetupComplete.cmd CVE-2019-1378
id: 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
status: test
description: Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
author: Florian Roth, oscd.community, Jonhnathan Ribeiro
references:
  - https://www.embercybersecurity.com/blog/cve-2019-1378-exploiting-an-access-control-privilege-escalation-vulnerability-in-windows-10-update-assistant-wua
date: 2019/11/15
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentCommandLine|contains|all:
      - '\cmd.exe'
      - '/c'
      - 'C:\Windows\Setup\Scripts\'
    ParentCommandLine|endswith:
      - 'SetupComplete.cmd'
      - 'PartnerSetupComplete.cmd'
  filter:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
      - 'C:\Windows\WinSxS\'
      - 'C:\Windows\Setup\'
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.execution
  - attack.t1059.003
  - attack.t1574
  - cve.2019.1378
