Windows: Detect sc.exe Service Creation with DACL Modification (sdset DCLCWPDTSD)
Alerts on sc.exe sdset usage with DCLCWPDTSD, suggesting permission changes to hide or impede service removal.
- Product
- windows
- Category
- process_creation
- Author
- Andreas Hunkeler (@Karneades) (SigmaHQ), DRL 1.1
- Published
- 2021-12-20
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of sc.exe where the command line includes sdset and the DACL string DCLCWPDTSD, indicating a service security descriptor change intended to restrict access. Attackers can use this to hide and make Windows services harder to remove by modifying the service’s permissions. It relies on Windows process creation telemetry, specifically the image/original filename identifying sc.exe and the command line contents indicating sdset plus the targeted DACL pattern.
Reporting behind it
- blog.talosintelligence.comhttps://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html
- sans.orghttps://www.sans.org/blog/red-team-tactics-hiding-windows-services/
- twitter.comhttps://twitter.com/Alh4zr3d/status/1580925761996828672
- itconnect.uw.eduhttps://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_sdset_hide_sevices.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect sc.exe Service Creation with DACL Modification (sdset DCLCWPDTSD)"
id: 2c950b8a-bbc9-436a-a502-79dd5b2c14f0
related:
- id: 99cf1e02-00fb-4c0d-8375-563f978dfd37
type: similar
- id: 98c5aeef-32d5-492f-b174-64a691896d25
type: similar
- id: a537cfc3-4297-4789-92b5-345bfd845ad0
type: derived
status: test
description: This rule flags process executions of sc.exe where the command line includes sdset and the DACL string DCLCWPDTSD, indicating a service security descriptor change intended to restrict access. Attackers can use this to hide and make Windows services harder to remove by modifying the service’s permissions. It relies on Windows process creation telemetry, specifically the image/original filename identifying sc.exe and the command line contents indicating sdset plus the targeted DACL pattern.
references:
- https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html
- https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
- https://twitter.com/Alh4zr3d/status/1580925761996828672
- https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_sdset_hide_sevices.yml
author: Andreas Hunkeler (@Karneades), Huntrule Team
date: 2021-12-20
modified: 2022-08-08
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.011
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \sc.exe
- OriginalFileName: sc.exe
selection_cli:
CommandLine|contains|all:
- sdset
- DCLCWPDTSD
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1