Windows: Detect sc.exe Creating Kernel Driver Services

title: "Windows: Detect sc.exe Creating Kernel Driver Services"
id: b1961c19-b8c1-4b88-8066-bf81753de62a
status: test
description: This rule identifies process executions of sc.exe that include commands to create a service configured with type set to kernel and a binPath for the driver. Attackers can use this to install malicious kernel-mode drivers for persistence and elevated control. It relies on Windows process creation telemetry capturing the sc.exe image path and the command-line parameters.
references:
  - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_new_kernel_driver.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-14
modified: 2025-10-07
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \sc.exe
    CommandLine|contains:
      - create
      - config
    CommandLine|contains|all:
      - binPath
      - type
      - kernel
  filter_optional_avira_driver:
    - CommandLine|contains|all:
        - create netprotection_network_filter
        - "type= kernel start= "
        - binPath= System32\drivers\netprotection_network_filter
        - DisplayName= netprotection_network_filter
        - group= PNP_TDI tag= yes
    - CommandLine|contains|all:
        - create avelam binpath=C:\Windows\system32\drivers\avelam.sys
        - type=kernel start=boot error=critical group=Early-Launch
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Rare legitimate installation of kernel drivers via sc.exe
level: medium
license: DRL-1.1
related:
  - id: 431a1fdb-4799-4f3b-91c3-a683b003fc49
    type: derived