msconfig.exe

System Configuration Utility file version info (xCyclopedia)

LOLBAS Execute 1 ATT&CK technique 1 documented command 7 known copies with hashes

How msconfig.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for msconfig.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution Administrator privileges

Executes command embeded in crafted c:\windows\system32\mscfgtlc.xml.

Msconfig.exe -5

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for msconfig.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for msconfig.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

T1218System Binary Proxy Execution

Is it the real msconfig.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionSystem Configuration Utility

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msconfig.exe · signed by Microsoft Windows

3de8b511f44473f772e2f4ea12ea7d44101ca8b5c0436188aaa70da9e8d70d14

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\msconfig.exe · signed by Microsoft Windows

93d2604f7fdf7f014ac5bef63ab177b6107f3cfc26da6cbd9a7ab50c96564a04

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\msconfig.exe · signed by Microsoft Windows

d651fd59887b01833f6434c3e7540ca0e3768e070dc986439355e981e92a110e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\msconfig.exe · signed by Microsoft Windows

e8a61e948e6e3f072ba33e2d5ab1133667646c52e51471c7022b72ff0592defb

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\msconfig.exe · signed by Microsoft Windows

2782a7f6336daf4cc25a88995456678f02afe0f01c86d24ef75cf54996710a75

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\msconfig.exe · not signed

9015edeb220c2ead7317b34466bef90c413b383fffb5f124585cb89aa29dce69

1, 0, 0, 1 · C:\Windows\system32\msconfig.exe · signed by Microsoft Windows

ac9b4a57be180e2bab2cc2718d017fe9fc806927da69b82b0baa229c4065ecd2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.