Identifier / Programs / Windows

settingsynchost.exe

Host Process for Setting Synchronization file version info (xCyclopedia)

LOLBAS Execute 1 ATT&CK technique 2 documented commands 10 known copies with hashes

How settingsynchost.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

-loadandrundiagscript

Execute T1218 System Binary Proxy Execution

-loadandrundiagscriptnocab

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for settingsynchost.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Execute file specified in %COMSPEC%

SettingSyncHost -LoadAndRunDiagScript {PATH:.exe}

Identify

Execute T1218 System Binary Proxy Execution User privileges

Execute a batch script in the background (no window ever pops up) which can be subverted to running arbitrary programs by setting the current working directory to %TMP% and creating files such as reg.bat/reg.exe in that directory thereby causing them to execute instead of the ones in C:\Windows\System32.

SettingSyncHost -LoadAndRunDiagScriptNoCab {PATH:.bat}

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for settingsynchost.exe, by Elliot Killick, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for settingsynchost.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

T1218System Binary Proxy Execution

Is it the real settingsynchost.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionHost Process for Setting Synchronization

10 known copies

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SettingSyncHost.exe · signed by Microsoft Windows

293fb25450df50173992d6d406dbd8bbd6b70e43c0b22383d0954b333aecd7d6

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\system32\SettingSyncHost.exe · signed by Microsoft Windows

f31163e9fc05d8490733c41d8fbb2b4fb407e1a4cef0b1e9855e5813b3026f98

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SettingSyncHost.exe · signed by Microsoft Windows

73d8f23a1acf635a39b2dcb8b37304658f6f84d1090af961ea031efab833d916

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SettingSyncHost.exe · signed by Microsoft Windows

93f35856509e6332e6b1ddc883e960a103b14ff2c12b66cdff2fed33f3c7659c

10.0.18362.239 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SettingSyncHost.exe · signed by Microsoft Windows

49be90c0f08c01de83bd01c503dce8480690ec2cf6b1d756673f0955b8874aad

10.0.18362.239 (WinBuild.160101.0800) · C:\WINDOWS\system32\SettingSyncHost.exe · signed by Microsoft Windows

55a7313dbee536185207fb38d23bd080908ad1f6709a3e1af196a1c1f8bf46b3

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SettingSyncHost.exe · signed by Microsoft Windows

020436dbaf8b73f2ca01edf68f8098a38bc1fef8551a51ef424b2c63f5df3bb1

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\SettingSyncHost.exe · signed by Microsoft Windows

c6f310ee401effb174271bb44d3ca76704c186e76995498d14c5c9b8040bad04

10.0.14393.3085 (rs1_release.190703-1816) · C:\Windows\SysWOW64\SettingSyncHost.exe · signed by Microsoft Windows

06e6fe30f85cea70c9727c678fb9293ec58c5c651e9c0db323b46f35abf8d7cb

10.0.14393.3085 (rs1_release.190703-1816) · C:\Windows\system32\SettingSyncHost.exe · signed by Microsoft Windows

d6a24ccc2d3fa93e3f9e5053c9da05a0ca2625c82be548543386d5ae5518b001

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.