Windows sc.exe Service Query for termservice Enumeration

title: Windows sc.exe Service Query for termservice Enumeration
id: 76a037b8-42dc-4962-9470-424cd10e9897
status: test
description: This rule flags process executions of sc.exe where the command line includes a service query and specifically references termservice. Attackers commonly enumerate available services to identify reachable targets and potential follow-on attack paths. Telemetry relied upon is Windows process creation events, including Image/OriginalFileName and CommandLine content matching sc.exe, the query operation, and termservice.
references:
  - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/
  - https://pentestlab.blog/tag/svchost/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-02-12
tags:
  - attack.t1003
  - attack.credential-access
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \sc.exe
    - OriginalFileName: sc.exe
  selection_cli:
    CommandLine|contains: query
  selection_cmd:
    CommandLine|contains: termservice
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: e83e8899-c9b2-483b-b355-5decc942b959
    type: derived