huntrule

Suspicious Modification of Service ImagePath or ServiceDll

PremiumReviewedSigma · Medium · v1
Product
windows
Category
registry_set
Author
HuntRule
Published
2026-09-27
Updated
2026-09-27
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects modification of a service ImagePath or ServiceDll value in the registry. Adversaries alter these values to hijack existing services or point them at malicious binaries for persistence and SYSTEM-level execution. Review changes for unsigned or unusual target paths, as legitimate updates also touch these keys.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange
Suspicious Windows Service Creation via New-Service or nssm
Suspicious svchost.exe Loading Unsigned DLL (via image_load)
Suspicious K7Soft Autostart Persistence
Suspicious Service ImagePath Pointing to ShieldNetWork Driver via Registry
Suspicious Scarab Service Persistence Registration via Registry (via registry_set)
Suspicious Embargo Service irnagentd Creation via Process Creation
Suspicious HotPage Driver Drop under ShieldNetWork Directory via File System
Malicious Vulnerable Driver Load by GentleKiller BYOVD EDR Killer
Malicious UPlugPlay Service Creation Masquerading as PlugPlay
Suspicious Modification of Service ImagePath or ServiceDll
Pivot detection · T1543.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.