Windows sc.exe Security Descriptor Tampering to Deny Service Access via sdset

title: Windows sc.exe Security Descriptor Tampering to Deny Service Access via sdset
id: 61753120-3e45-4f3d-9bd3-7e6964ad1807
related:
  - id: 98c5aeef-32d5-492f-b174-64a691896d25
    type: similar
  - id: a537cfc3-4297-4789-92b5-345bfd845ad0
    type: similar
  - id: 99cf1e02-00fb-4c0d-8375-563f978dfd37
    type: derived
status: test
description: This rule flags process executions of sc.exe where the command line includes sdset and a DACL entry beginning with 'D;', indicating a deny-access security descriptor modification. It further narrows matches to cases targeting critical trustee SIDs in the command line (e.g., logged-on user, service logon user, built-in administrators, local system, or everyone). Denying access to a service can be used to disrupt management or persistence by preventing legitimate users and services from interacting with it, and the rule relies on Windows process creation telemetry capturing the full command line.
references:
  - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
  - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
  - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_sdset_deny_service_access.yml
author: Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2020-10-16
modified: 2023-02-28
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    - Image|endswith: \sc.exe
    - OriginalFileName: sc.exe
  selection_sdset:
    CommandLine|contains|all:
      - sdset
      - D;
  selection_trustee:
    CommandLine|contains:
      - ;IU
      - ;SU
      - ;BA
      - ;SY
      - ;WD
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1