Windows sc.exe Service Query for termservice Enumeration

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003OS Credential Dumping
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of sc.exe where the command line includes a service query and specifically references termservice. Attackers commonly enumerate available services to identify reachable targets and potential follow-on attack paths. Telemetry relied upon is Windows process creation events, including Image/OriginalFileName and CommandLine content matching sc.exe, the query operation, and termservice.

Reporting behind it

Related detections9 linkedT1003 — drag to rearrange

Malicious Wdigest Authentication Enabled - Reg via Command (via process_creation)

Malicious Diskshadow Command Abuse to Expose VSS Backup (via process_creation)

Malicious IIS Application Pool Credential Dumping (via process_creation)

Malicious Wdigest Authentication Enabled - Registry (via registry_set)

Suspicious Veeam Backup Credential Harvesting via PowerShell (via ps_script)

Suspicious Network Provider Registration for Credential Interception via NPPSpy

Malicious Mimikatz Malicious Security Package (SSP) Exfiltrates Cleartext Passwords in File (via file_event)

Malicious WDigest UseLogonCredential Enablement For Credential Theft

Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes

Windows sc.exe Service Query for termservice Enumeration

Pivot detection · T1003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-sc-exe-service-query-for-termservice-enumeration-e83e8899

title: Windows sc.exe Service Query for termservice Enumeration
id: 76a037b8-42dc-4962-9470-424cd10e9897
status: test
description: This rule flags process executions of sc.exe where the command line includes a service query and specifically references termservice. Attackers commonly enumerate available services to identify reachable targets and potential follow-on attack paths. Telemetry relied upon is Windows process creation events, including Image/OriginalFileName and CommandLine content matching sc.exe, the query operation, and termservice.
references:
  - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/
  - https://pentestlab.blog/tag/svchost/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-02-12
tags:
  - attack.t1003
  - attack.credential-access
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \sc.exe
    - OriginalFileName: sc.exe
  selection_cli:
    CommandLine|contains: query
  selection_cmd:
    CommandLine|contains: termservice
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: e83e8899-c9b2-483b-b355-5decc942b959
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL