MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows
Msconfig.exe -5
Executes command embeded in crafted c:\windows\system32\mscfgtlc.xml.
Code execution using Msconfig.exe
C:\Windows\System32\msconfig.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_uac_bypass_msconfig_gui.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/file/file_event/file_event_win_uac_bypass_msconfig_gui.yml, IOC: mscfgtlc.xml changes in system32 folder
Pierre-Alexandre Braeken (@pabraeken)