PowerShell Script Block Monitoring for Service Registry Permission Weakness Checks on Windows

title: PowerShell Script Block Monitoring for Service Registry Permission Weakness Checks on Windows
id: 26dc036d-5242-4c57-9c8b-e65caf645822
status: test
description: This rule identifies PowerShell scripts that check access control on the Windows Registry service configuration paths under HKLM\SYSTEM\CurrentControlSet\Services. Attackers and administrators use these checks to identify or confirm weak permissions that could allow service executable hijacking. The detection relies on Script Block Logging telemetry by matching script content that contains both "get-acl" and the targeted Registry path prefix.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_acl_service.yml
author: frack113, Huntrule Team
date: 2021-12-30
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.011
  - stp.2a
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - get-acl
      - REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\
  condition: selection
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1
related:
  - id: 95afc12e-3cbb-40c3-9340-84a032e596a3
    type: derived