Windows PowerShell Set-Service SDDL Usage to Hide Services
Flags pwsh Set-Service commands that set a SecurityDescriptorSddl to hide a Windows service from other tools.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-17
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell (pwsh.exe) process executions that invoke Set-Service with a SecurityDescriptorSddl containing DCLCWPDTSD. Attackers can use service security descriptor changes to hide services from common utilities such as sc.exe and Get-Service, supporting persistence and stealth. The detection relies on Windows process creation telemetry, matching the command line for the Set-Service invocation and specific SDDL components.
Reporting behind it
- twitter.comhttps://twitter.com/Alh4zr3d/status/1580925761996828672
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_hide_services_via_set_service.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Set-Service SDDL Usage to Hide Services
id: 36e250f3-cd25-4d98-b686-cb76a7e5334b
related:
- id: a537cfc3-4297-4789-92b5-345bfd845ad0
type: derived
- id: 953945c5-22fe-4a92-9f8a-a9edc1e522da
type: similar
- id: 514e4c3a-c77d-4cde-a00f-046425e2301e
type: derived
status: test
description: This rule identifies PowerShell (pwsh.exe) process executions that invoke Set-Service with a SecurityDescriptorSddl containing DCLCWPDTSD. Attackers can use service security descriptor changes to hide services from common utilities such as sc.exe and Get-Service, supporting persistence and stealth. The detection relies on Windows process creation telemetry, matching the command line for the Set-Service invocation and specific SDDL components.
references:
- https://twitter.com/Alh4zr3d/status/1580925761996828672
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_hide_services_via_set_service.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-17
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.011
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \pwsh.exe
- OriginalFileName: pwsh.dll
selection_sddl:
CommandLine|contains|all:
- "Set-Service "
- DCLCWPDTSD
selection_cmdlet:
CommandLine|contains:
- "-SecurityDescriptorSddl "
- "-sd "
condition: all of selection_*
falsepositives:
- Rare intended use of hidden services
level: high
license: DRL-1.1