PowerShell: Suspicious Set-Service SDDL to Hide Windows Services from Enumeration

Flags PowerShell ScriptBlock activity using Set-Service with specific SDDL elements consistent with hiding services from tools like sc.exe.

FreeUnreviewedSigmahighv1

powershell-suspicious-set-service-sddl-to-hide-windows-services-from-enumeration-22d80745

title: "PowerShell: Suspicious Set-Service SDDL to Hide Windows Services from Enumeration"
id: f26ef7db-e8d9-477a-abf2-60a9e4112c0b
related:
  - id: a95b9b42-1308-4735-a1af-abb1c5e6f5ac
    type: similar
  - id: 22d80745-6f2c-46da-826b-77adaededd74
    type: derived
status: test
description: This rule identifies PowerShell ScriptBlock logging content where Set-Service is used with a security descriptor SDDL that includes a hidden-service style D;; value and well-known SID group entries. Attackers can abuse service security descriptors to reduce visibility from common enumeration tools, supporting persistence and stealth. The detection relies on ScriptBlockText containing the Set-Service call and specific SDDL substrings such as -SecurityDescriptorSddl/-sd and the SID segments listed by the rule.
references:
  - https://twitter.com/Alh4zr3d/status/1580925761996828672
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_service_dacl_modification_set_service.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-24
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.011
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_sddl_flag:
    ScriptBlockText|contains:
      - "-SecurityDescriptorSddl "
      - "-sd "
  selection_set_service:
    ScriptBlockText|contains|all:
      - "Set-Service "
      - D;;
    ScriptBlockText|contains:
      - ;;;IU
      - ;;;SU
      - ;;;BA
      - ;;;SY
      - ;;;WD
  condition: all of selection_*
falsepositives:
  - Rare intended use of hidden services
  - Rare FP could occur due to the non linearity of the ScriptBlockText log
level: high
license: DRL-1.1

What it detects

This rule identifies PowerShell ScriptBlock logging content where Set-Service is used with a security descriptor SDDL that includes a hidden-service style D;; value and well-known SID group entries. Attackers can abuse service security descriptors to reduce visibility from common enumeration tools, supporting persistence and stealth. The detection relies on ScriptBlockText containing the Set-Service call and specific SDDL substrings such as -SecurityDescriptorSddl/-sd and the SID segments listed by the rule.

Known false positives

Rare intended use of hidden services
Rare FP could occur due to the non linearity of the ScriptBlockText log

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.