Windows Registry Set: ServiceDll Path Ending with \CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll
Alerts on Windows registry writes to a specific Services\wercplsupport\Parameters\ServiceDll target path.
- Product
- windows
- Category
- registry_set
- Author
- Trent Liffick (@tliffick) (SigmaHQ), DRL 1.1
- Published
- 2020-05-14
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry modifications on Windows where the recorded target object ends with a specific ServiceDll parameter path under the CurrentControlSet. Attackers commonly use ServiceDll values to influence what code a service loads, enabling persistence or defense evasion. The detection relies on registry set event telemetry that includes a TargetObject field.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry Set: ServiceDll Path Ending with \\CurrentControlSet\\Services\\wercplsupport\\Parameters\\ServiceDll"
id: 686c23c3-314a-442c-82e1-6d0948d0b890
related:
- id: c3198a27-23a0-4c2c-af19-e5328d49680e
type: derived
- id: 92b0b372-a939-44ed-a11b-5136cf680e27
type: derived
status: test
description: This rule identifies registry modifications on Windows where the recorded target object ends with a specific ServiceDll parameter path under the CurrentControlSet. Attackers commonly use ServiceDll values to influence what code a service loads, enabling persistence or defense evasion. The detection relies on registry set event telemetry that includes a TargetObject field.
references:
- https://redcanary.com/blog/blue-mockingbird-cryptominer/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Blue-Mockingbird/registry_set_mal_blue_mockingbird.yml
author: Trent Liffick (@tliffick), Huntrule Team
date: 2020-05-14
modified: 2023-08-17
tags:
- attack.execution
- attack.persistence
- attack.defense-impairment
- attack.t1112
- attack.t1047
- detection.emerging-threats
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|endswith: \CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1