Windows Registry ServiceDll Hijack via Service Parameters\ServiceDll

title: Windows Registry ServiceDll Hijack via Service Parameters\ServiceDll
id: e203f9ac-d3d6-4b36-9acc-0b12c59c56e1
status: test
description: This rule flags registry modifications to a service's Parameters\ServiceDll value within ControlSet\Services paths under \System\. Changing ServiceDll can be used to redirect a service to load attacker-chosen DLLs for persistence. It relies on registry set telemetry capturing the TargetObject path and associated Details, and applies exclusions for a small set of known binaries and specific service/DLL combinations.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md#atomic-test-4---tinyturla-backdoor-service-w64time
  - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_servicedll_hijack.yml
author: frack113, Huntrule Team
date: 2022-02-04
modified: 2024-04-03
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains|all:
      - \System\
      - ControlSet
      - \Services\
    TargetObject|endswith: \Parameters\ServiceDll
  filter_main_printextensionmanger:
    Details: C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll
  filter_main_domain_controller:
    Image: C:\Windows\system32\lsass.exe
    TargetObject|endswith: \Services\NTDS\Parameters\ServiceDll
    Details: "%%systemroot%%\\system32\\ntdsa.dll"
  filter_main_poqexec:
    Image: C:\Windows\System32\poqexec.exe
  filter_optional_safetica:
    Image|endswith: \regsvr32.exe
    Details: C:\Windows\System32\STAgent.dll
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Administrative scripts
  - Installation of a service
level: medium
license: DRL-1.1
related:
  - id: 612e47e9-8a59-43a6-b404-f48683f45bd6
    type: derived