.. / Msconfig.exe
Star

MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows


Paths:


Resources:
https://twitter.com/pabraeken/status/991314564896690177

Acknowledgement:
Pierre-Alexandre Braeken - @pabraeken


Detection:
mscfgtlc.xml changes in system32 folder
msconfig.exe executing



Execute

Executes command embeded in crafted c:\windows\system32\mscfgtlc.xml.
Msconfig.exe -5
Usecase:Code execution using Msconfig.exe
Privileges required:Administrator
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1218