PowerShell Set-Service SecurityDescriptor (DCLCWPDTSD) to Hide Services
Flags PowerShell Set-Service calls that set a SecurityDescriptor SDDL (DCLCWPDTSD) to hide services from other utilities.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-17
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell activity where the Set-Service cmdlet is used with a SecurityDescriptor value containing DCLCWPDTSD. The behavior is relevant because altering a service’s security descriptor can be used to hide it from common service management utilities. The detection relies on Script Block Logging telemetry capturing the ScriptBlockText content with the expected Set-Service and SecurityDescriptor SDDL fragments.
Reporting behind it
- twitter.comhttps://twitter.com/Alh4zr3d/status/1580925761996828672
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_using_set_service_to_hide_services.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Set-Service SecurityDescriptor (DCLCWPDTSD) to Hide Services
id: 483aa84c-9118-4738-bc45-f2be4164471e
related:
- id: 514e4c3a-c77d-4cde-a00f-046425e2301e
type: similar
- id: 953945c5-22fe-4a92-9f8a-a9edc1e522da
type: derived
status: test
description: This rule identifies PowerShell activity where the Set-Service cmdlet is used with a SecurityDescriptor value containing DCLCWPDTSD. The behavior is relevant because altering a service’s security descriptor can be used to hide it from common service management utilities. The detection relies on Script Block Logging telemetry capturing the ScriptBlockText content with the expected Set-Service and SecurityDescriptor SDDL fragments.
references:
- https://twitter.com/Alh4zr3d/status/1580925761996828672
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_using_set_service_to_hide_services.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-17
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.011
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- "Set-Service "
- DCLCWPDTSD
ScriptBlockText|contains:
- "-SecurityDescriptorSddl "
- "-sd "
condition: selection
falsepositives:
- Rare intended use of hidden services
- Rare FP could occur due to the non linearity of the ScriptBlockText log
level: high
license: DRL-1.1