Setup16.EXE Execution With Custom .Lst File

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•4•0•45

Detects the execution of "Setup16.EXE", an old installation utility, with a custom ".lst" file. These ".lst" files can contain references to external programs that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a Living Off The Land (LOLBIN) utility for various malicious purposes.