Windows Registry Change: ServiceDll Path Ending in \CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll

title: "Windows Registry Change: ServiceDll Path Ending in \\CurrentControlSet\\Services\\wercplsupport\\Parameters\\ServiceDll"
id: 686c23c3-314a-442c-82e1-6d0948d0b890
related:
  - id: c3198a27-23a0-4c2c-af19-e5328d49680e
    type: derived
  - id: 92b0b372-a939-44ed-a11b-5136cf680e27
    type: derived
status: test
description: This rule flags Windows registry writes where the TargetObject ends with the specific Services\wercplsupport\Parameters\ServiceDll path. Attackers can use ServiceDll settings to establish persistence by redirecting service DLL loading, or to impair defenses via unauthorized service-related configuration changes. Detection relies on registry-set telemetry that records the TargetObject value for each registry modification event.
references:
  - https://redcanary.com/blog/blue-mockingbird-cryptominer/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Blue-Mockingbird/registry_set_mal_blue_mockingbird.yml
author: Trent Liffick (@tliffick), Huntrule Team
date: 2020-05-14
modified: 2023-08-17
tags:
  - attack.execution
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
  - attack.t1047
  - detection.emerging-threats
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: \CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1