Windows: Detect sc.exe Service Creation with DACL Modification (sdset DCLCWPDTSD)

title: "Windows: Detect sc.exe Service Creation with DACL Modification (sdset DCLCWPDTSD)"
id: 2c950b8a-bbc9-436a-a502-79dd5b2c14f0
related:
  - id: 99cf1e02-00fb-4c0d-8375-563f978dfd37
    type: similar
  - id: 98c5aeef-32d5-492f-b174-64a691896d25
    type: similar
  - id: a537cfc3-4297-4789-92b5-345bfd845ad0
    type: derived
status: test
description: This rule flags process executions of sc.exe where the command line includes sdset and the DACL string DCLCWPDTSD, indicating a service security descriptor change intended to restrict access. Attackers can use this to hide and make Windows services harder to remove by modifying the service’s permissions. It relies on Windows process creation telemetry, specifically the image/original filename identifying sc.exe and the command line contents indicating sdset plus the targeted DACL pattern.
references:
  - https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html
  - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
  - https://twitter.com/Alh4zr3d/status/1580925761996828672
  - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_sdset_hide_sevices.yml
author: Andreas Hunkeler (@Karneades), Huntrule Team
date: 2021-12-20
modified: 2022-08-08
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.011
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \sc.exe
    - OriginalFileName: sc.exe
  selection_cli:
    CommandLine|contains|all:
      - sdset
      - DCLCWPDTSD
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1