Windows: sc.exe Service Configuration Changed by Medium-Integrity Users
Alerts on sc.exe runs from Medium-integrity users that include service config/binPath or failure command changes.
- Product
- windows
- Category
- process_creation
- Author
- Teymur Kheirkhabarov (SigmaHQ), DRL 1.1
- Published
- 2019-10-26
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags executions of sc.exe by a user running at Medium integrity level where the command line includes both config and binPath, indicating an attempt to set a service's binary path. It also matches sc.exe invocations that include failure and command, consistent with altering service failure behavior. These actions can help attackers persist and influence elevated execution paths, so the rule relies on Windows process creation telemetry capturing the sc.exe image name, integrity level, and command-line arguments.
Reporting behind it
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
- pentestlab.bloghttps://pentestlab.blog/2017/03/30/weak-service-permissions/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: sc.exe Service Configuration Changed by Medium-Integrity Users"
id: 2db29cd2-5031-48db-9b59-74eb00823f66
status: test
description: This rule flags executions of sc.exe by a user running at Medium integrity level where the command line includes both config and binPath, indicating an attempt to set a service's binary path. It also matches sc.exe invocations that include failure and command, consistent with altering service failure behavior. These actions can help attackers persist and influence elevated execution paths, so the rule relies on Windows process creation telemetry capturing the sc.exe image name, integrity level, and command-line arguments.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
- https://pentestlab.blog/2017/03/30/weak-service-permissions/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml
author: Teymur Kheirkhabarov, Huntrule Team
date: 2019-10-26
modified: 2024-12-01
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.011
logsource:
category: process_creation
product: windows
detection:
scbynonadmin:
Image|endswith: \sc.exe
IntegrityLevel:
- Medium
- S-1-16-8192
selection_binpath:
CommandLine|contains|all:
- config
- binPath
selection_failure:
CommandLine|contains|all:
- failure
- command
condition: scbynonadmin and 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: d937b75f-a665-4480-88a5-2f20e9f9b22a
type: derived