Possible Service Registry Key Read Access Request (via security)

title: Possible Service Registry Key Read Access Request (via security)
id: 63eeb702-f70e-55b3-b73e-7b849a737d84
status: stable
description: This rule detects "read access" requests on the services registry key. Adversaries may execute their own hostile payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, to launch their own code when a service starts.
references:
    - https://attack.mitre.org/techniques/T1574/011/
    - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
author: Huntrule Team
date: 2026-02-25
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.011
logsource:
    product: windows
    service: security
    definition: 'Requirements: SACLs must be enabled for "READ_CONTROL" on the registry keys used in this rule'
detection:
    selection:
        EventID: 4663
        ObjectName|contains|all:
            - '\SYSTEM\'
            - 'ControlSet\Services\'
        AccessList|contains: '%%1538'
    condition: selection
falsepositives:
    - Unknown
level: low