Windows PowerShell: Set-Service SDDL/SecurityDescriptor to hide services

Flags PowerShell Set-Service calls that set a SecurityDescriptor SDDL (DCLCWPDTSD) to hide services from other utilities.

FreeUnreviewedSigmahighv1

windows-powershell-set-service-sddl-securitydescriptor-to-hide-services-953945c5

title: "Windows PowerShell: Set-Service SDDL/SecurityDescriptor to hide services"
id: 483aa84c-9118-4738-bc45-f2be4164471e
related:
  - id: 514e4c3a-c77d-4cde-a00f-046425e2301e
    type: similar
  - id: 953945c5-22fe-4a92-9f8a-a9edc1e522da
    type: derived
status: test
description: This rule identifies PowerShell usage of the Set-Service cmdlet with SecurityDescriptor SDDL values associated with the DCLCWPDTSD pattern. By adjusting a service’s security descriptor, an attacker may hide the service from common administrative tools such as sc.exe and Get-Service, reducing visibility and supporting stealth. The detection relies on Script Block Logging telemetry capturing the PowerShell script text containing Set-Service and the specific SecurityDescriptor/Sddl parameters.
references:
  - https://twitter.com/Alh4zr3d/status/1580925761996828672
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_using_set_service_to_hide_services.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-17
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.011
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "Set-Service "
      - DCLCWPDTSD
    ScriptBlockText|contains:
      - "-SecurityDescriptorSddl "
      - "-sd "
  condition: selection
falsepositives:
  - Rare intended use of hidden services
  - Rare FP could occur due to the non linearity of the ScriptBlockText log
level: high
license: DRL-1.1

What it detects

This rule identifies PowerShell usage of the Set-Service cmdlet with SecurityDescriptor SDDL values associated with the DCLCWPDTSD pattern. By adjusting a service’s security descriptor, an attacker may hide the service from common administrative tools such as sc.exe and Get-Service, reducing visibility and supporting stealth. The detection relies on Script Block Logging telemetry capturing the PowerShell script text containing Set-Service and the specific SecurityDescriptor/Sddl parameters.

Known false positives

Rare intended use of hidden services
Rare FP could occur due to the non linearity of the ScriptBlockText log

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.