Add SystemSettingsAdminFlow.exe as a LOLBin

[JasonPhang98]

This pull request adds SystemSettingsAdminFlow.exe as a new entry to the LOLBAS project under the OSBinaries category.

SystemSettingsAdminFlow.exe is a legitimate Windows executable used to handle administrative flows in system settings. However, it can be abused to modify critical Windows Defender settings, such as disabling enhanced notifications, submission consent, and real-time protection, allowing for execution of malicious payloads without detection.

The included YAML file demonstrates commands that attackers could use to manipulate Defender settings.
This activity maps to T1562.001 (Impair Defenses: Disable or Modify Tools).

Included relevant links for further reading and validation:
https://www.huntress.com/blog/lolbin-to-inc-ransomware
https://www.huntress.com/blog/its-not-safe-to-pay-safepay

[wietze]

Hey @JasonPhang98, thanks for taking the time to document this entry.
I think you mean the binary SystemSettingsAdminFlows.exe, rather than SystemSettingsFlowAdmin or SystemSettingsAdminFlow.

That said, I cannot get the command to work on Windows 11 23H2; not when I set it to 1 or 0. Similarly, other commands listed in the Huntress blog post seem to have no effect whatsoever on the Windows Defender settings.

Perhaps I'm missing a trick - have you been able to get this to work? Your entry lists specific Windows 10 entries, have you been able to confirm it works on those?

[wietze]

See above.