Detection idea
setupugc.exe is a signed Windows deployment binary that LOLBAS documents as usable for proxy execution. On Windows 10/11 and Windows Server 2025, an administrator can configure a command at:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\
Setup-Unattend-Settings\RunSynchronous\<n>\Path
Then invoking setupugc.exe specialize or setupugc.exe auditUser causes the configured command to run.
Proposed detection
Detect setupugc.exe invoked with either execution mode when its parent is not the normal Windows Setup context (setup.exe or setuphost.exe).
This narrows the rule to the documented proxy-execution behavior while excluding the expected deployment parent processes.
References
Implementation
PR #6152 contains a focused Windows process-creation rule and local validation results.
Detection idea
setupugc.exeis a signed Windows deployment binary that LOLBAS documents as usable for proxy execution. On Windows 10/11 and Windows Server 2025, an administrator can configure a command at:Then invoking
setupugc.exe specializeorsetupugc.exe auditUsercauses the configured command to run.Proposed detection
Detect
setupugc.exeinvoked with either execution mode when its parent is not the normal Windows Setup context (setup.exeorsetuphost.exe).This narrows the rule to the documented proxy-execution behavior while excluding the expected deployment parent processes.
References
Implementation
PR #6152 contains a focused Windows process-creation rule and local validation results.