huntrule

Windows: Detect sc.exe Service Config binPath Changes to Suspicious Commands/Paths

Alerts when sc.exe updates a service binPath to point at suspicious commands or commonly abused directories.

FreeUnreviewedSigmahighv1
title: "Windows: Detect sc.exe Service Config binPath Changes to Suspicious Commands/Paths"
id: 36d8de08-739c-490f-bc79-2c5e75aa3347
status: test
description: This rule flags Windows process creation events where sc.exe is used to modify a service configuration containing both "config" and "binPath", with the command line referencing a suspicious script execution tool or executable path. Service path changes matter because they can redirect how a service runs on startup, enabling persistence or privilege escalation. It relies on process creation telemetry capturing the image path (sc.exe) and the full command line text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md
  - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_service_path_modification.yml
author: Victor Sergeev, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-21
modified: 2022-11-18
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \sc.exe
    CommandLine|contains|all:
      - config
      - binPath
    CommandLine|contains:
      - powershell
      - "cmd "
      - mshta
      - wscript
      - cscript
      - rundll32
      - svchost
      - dllhost
      - cmd.exe /c
      - cmd.exe /k
      - cmd.exe /r
      - cmd /c
      - cmd /k
      - cmd /r
      - C:\Users\Public
      - \Downloads\
      - \Desktop\
      - \Microsoft\Windows\Start Menu\Programs\Startup\
      - C:\Windows\TEMP\
      - \AppData\Local\Temp
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 138d3531-8793-4f50-a2cd-f291b2863d78
    type: derived

What it detects

This rule flags Windows process creation events where sc.exe is used to modify a service configuration containing both "config" and "binPath", with the command line referencing a suspicious script execution tool or executable path. Service path changes matter because they can redirect how a service runs on startup, enabling persistence or privilege escalation. It relies on process creation telemetry capturing the image path (sc.exe) and the full command line text.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.