Windows: sc.exe Service Configuration Changed by Medium-Integrity Users

title: "Windows: sc.exe Service Configuration Changed by Medium-Integrity Users"
id: 2db29cd2-5031-48db-9b59-74eb00823f66
status: test
description: This rule flags executions of sc.exe by a user running at Medium integrity level where the command line includes both config and binPath, indicating an attempt to set a service's binary path. It also matches sc.exe invocations that include failure and command, consistent with altering service failure behavior. These actions can help attackers persist and influence elevated execution paths, so the rule relies on Windows process creation telemetry capturing the sc.exe image name, integrity level, and command-line arguments.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  - https://pentestlab.blog/2017/03/30/weak-service-permissions/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml
author: Teymur Kheirkhabarov, Huntrule Team
date: 2019-10-26
modified: 2024-12-01
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.011
logsource:
  category: process_creation
  product: windows
detection:
  scbynonadmin:
    Image|endswith: \sc.exe
    IntegrityLevel:
      - Medium
      - S-1-16-8192
  selection_binpath:
    CommandLine|contains|all:
      - config
      - binPath
  selection_failure:
    CommandLine|contains|all:
      - failure
      - command
  condition: scbynonadmin and 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d937b75f-a665-4480-88a5-2f20e9f9b22a
    type: derived