Windows PowerShell ScriptBlock checks for service registry ACL inspection
Flags PowerShell scripts that use Get-ACL to inspect service Registry keys under HKLM\SYSTEM\CurrentControlSet\Services.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-30
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script blocks that contain both 'get-acl' and a Registry provider path under HKLM\SYSTEM\CurrentControlSet\Services. It is intended to identify attempts to inspect permissions on service registry entries, which can enable redirecting a service’s configured executable to an attacker-controlled payload. The detection relies on Script Block Logging telemetry capturing the relevant command text and Registry path within the same script block.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_acl_service.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell ScriptBlock checks for service registry ACL inspection
id: 26dc036d-5242-4c57-9c8b-e65caf645822
status: test
description: This rule flags PowerShell script blocks that contain both 'get-acl' and a Registry provider path under HKLM\SYSTEM\CurrentControlSet\Services. It is intended to identify attempts to inspect permissions on service registry entries, which can enable redirecting a service’s configured executable to an attacker-controlled payload. The detection relies on Script Block Logging telemetry capturing the relevant command text and Registry path within the same script block.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_acl_service.yml
author: frack113, Huntrule Team
date: 2021-12-30
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574.011
- stp.2a
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- get-acl
- REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\
condition: selection
falsepositives:
- Legitimate administrative script
level: medium
license: DRL-1.1
related:
- id: 95afc12e-3cbb-40c3-9340-84a032e596a3
type: derived