Windows Registry ServiceDll Hijack via Service Parameters\ServiceDll
Alerts on ServiceDll value changes for Windows services in the registry, indicating potential DLL load persistence.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-04
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry modifications to a service's Parameters\ServiceDll value within ControlSet\Services paths under \System\. Changing ServiceDll can be used to redirect a service to load attacker-chosen DLLs for persistence. It relies on registry set telemetry capturing the TargetObject path and associated Details, and applies exclusions for a small set of known binaries and specific service/DLL combinations.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md#atomic-test-4---tinyturla-backdoor-service-w64time
- hexacorn.comhttps://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_servicedll_hijack.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry ServiceDll Hijack via Service Parameters\ServiceDll
id: e203f9ac-d3d6-4b36-9acc-0b12c59c56e1
status: test
description: This rule flags registry modifications to a service's Parameters\ServiceDll value within ControlSet\Services paths under \System\. Changing ServiceDll can be used to redirect a service to load attacker-chosen DLLs for persistence. It relies on registry set telemetry capturing the TargetObject path and associated Details, and applies exclusions for a small set of known binaries and specific service/DLL combinations.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md#atomic-test-4---tinyturla-backdoor-service-w64time
- https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_servicedll_hijack.yml
author: frack113, Huntrule Team
date: 2022-02-04
modified: 2024-04-03
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1543.003
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains|all:
- \System\
- ControlSet
- \Services\
TargetObject|endswith: \Parameters\ServiceDll
filter_main_printextensionmanger:
Details: C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll
filter_main_domain_controller:
Image: C:\Windows\system32\lsass.exe
TargetObject|endswith: \Services\NTDS\Parameters\ServiceDll
Details: "%%systemroot%%\\system32\\ntdsa.dll"
filter_main_poqexec:
Image: C:\Windows\System32\poqexec.exe
filter_optional_safetica:
Image|endswith: \regsvr32.exe
Details: C:\Windows\System32\STAgent.dll
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Administrative scripts
- Installation of a service
level: medium
license: DRL-1.1
related:
- id: 612e47e9-8a59-43a6-b404-f48683f45bd6
type: derived