PowerShell: Suspicious Set-Service DACL/SecurityDescriptor Modification for Hidden Services
Flags PowerShell ScriptBlock activity using Set-Service with specific SDDL elements consistent with hiding services from tools like sc.exe.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-24
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell usage of the Set-Service cmdlet where the script block contains SecurityDescriptor SDDL parameters indicating a DACL/security descriptor change. The match is further constrained to SDDL fragments suggesting access control entries consistent with hiding or restricting visibility of the service to common utilities. Attackers may use this to persist while reducing discovery by tools such as sc.exe and Get-Service. It relies on Script Block Logging telemetry capturing the cmdlet arguments in ScriptBlockText.
Reporting behind it
- twitter.comhttps://twitter.com/Alh4zr3d/status/1580925761996828672
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_service_dacl_modification_set_service.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "PowerShell: Suspicious Set-Service DACL/SecurityDescriptor Modification for Hidden Services"
id: f26ef7db-e8d9-477a-abf2-60a9e4112c0b
related:
- id: a95b9b42-1308-4735-a1af-abb1c5e6f5ac
type: similar
- id: 22d80745-6f2c-46da-826b-77adaededd74
type: derived
status: test
description: This rule flags PowerShell usage of the Set-Service cmdlet where the script block contains SecurityDescriptor SDDL parameters indicating a DACL/security descriptor change. The match is further constrained to SDDL fragments suggesting access control entries consistent with hiding or restricting visibility of the service to common utilities. Attackers may use this to persist while reducing discovery by tools such as sc.exe and Get-Service. It relies on Script Block Logging telemetry capturing the cmdlet arguments in ScriptBlockText.
references:
- https://twitter.com/Alh4zr3d/status/1580925761996828672
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_service_dacl_modification_set_service.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-24
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.011
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_sddl_flag:
ScriptBlockText|contains:
- "-SecurityDescriptorSddl "
- "-sd "
selection_set_service:
ScriptBlockText|contains|all:
- "Set-Service "
- D;;
ScriptBlockText|contains:
- ;;;IU
- ;;;SU
- ;;;BA
- ;;;SY
- ;;;WD
condition: all of selection_*
falsepositives:
- Rare intended use of hidden services
- Rare FP could occur due to the non linearity of the ScriptBlockText log
level: high
license: DRL-1.1