Windows sc.exe Security Descriptor Tampering to Deny Service Access via sdset
Alerts on sc.exe sdset commands that modify service security descriptors to deny access to critical trustees.
- Product
- windows
- Category
- process_creation
- Author
- Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-16
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of sc.exe where the command line includes sdset and a DACL entry beginning with 'D;', indicating a deny-access security descriptor modification. It further narrows matches to cases targeting critical trustee SIDs in the command line (e.g., logged-on user, service logon user, built-in administrators, local system, or everyone). Denying access to a service can be used to disrupt management or persistence by preventing legitimate users and services from interacting with it, and the rule relies on Windows process creation telemetry capturing the full command line.
Reporting behind it
- sans.orghttps://www.sans.org/blog/red-team-tactics-hiding-windows-services/
- itconnect.uw.eduhttps://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_sdset_deny_service_access.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows sc.exe Security Descriptor Tampering to Deny Service Access via sdset
id: 61753120-3e45-4f3d-9bd3-7e6964ad1807
related:
- id: 98c5aeef-32d5-492f-b174-64a691896d25
type: similar
- id: a537cfc3-4297-4789-92b5-345bfd845ad0
type: similar
- id: 99cf1e02-00fb-4c0d-8375-563f978dfd37
type: derived
status: test
description: This rule flags process executions of sc.exe where the command line includes sdset and a DACL entry beginning with 'D;', indicating a deny-access security descriptor modification. It further narrows matches to cases targeting critical trustee SIDs in the command line (e.g., logged-on user, service logon user, built-in administrators, local system, or everyone). Denying access to a service can be used to disrupt management or persistence by preventing legitimate users and services from interacting with it, and the rule relies on Windows process creation telemetry capturing the full command line.
references:
- https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
- https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
- https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_sdset_deny_service_access.yml
author: Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2020-10-16
modified: 2023-02-28
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1543.003
logsource:
category: process_creation
product: windows
detection:
selection_sc:
- Image|endswith: \sc.exe
- OriginalFileName: sc.exe
selection_sdset:
CommandLine|contains|all:
- sdset
- D;
selection_trustee:
CommandLine|contains:
- ;IU
- ;SU
- ;BA
- ;SY
- ;WD
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1