Windows Service Registry Key ReadControl Access (Event ID 4663)
Flags READ_CONTROL access requests to service registry keys (\SYSTEM\ControlSet\Services\) via Windows Security Event 4663.
- Product
- windows
- Service
- security
- Author
- Center for Threat Informed Defense (CTID) Summiting the Pyramid Team (SigmaHQ), DRL 1.1
- Published
- 2023-09-28
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security Event ID 4663 activity where a subject requests READ_CONTROL (AccessList %%1538) on registry paths under \SYSTEM\ControlSet\Services\, indicating read access to service registry configuration. Such access is relevant because it can support attempts to inspect, modify, or abuse service-related registry permissions to influence what a service runs. Telemetry relies on Security auditing for registry object access and the event’s ObjectName and AccessList fields.
Reporting behind it
- center-for-threat-informed-defense.github.iohttps://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_registry_permissions_weakness_check.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Service Registry Key ReadControl Access (Event ID 4663)
id: 1120db92-0ec0-4ec7-ad69-1e5bec310376
status: test
description: This rule flags Windows Security Event ID 4663 activity where a subject requests READ_CONTROL (AccessList %%1538) on registry paths under \SYSTEM\ControlSet\Services\, indicating read access to service registry configuration. Such access is relevant because it can support attempts to inspect, modify, or abuse service-related registry permissions to influence what a service runs. Telemetry relies on Security auditing for registry object access and the event’s ObjectName and AccessList fields.
references:
- https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_registry_permissions_weakness_check.yml
author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team, Huntrule Team
date: 2023-09-28
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.011
logsource:
product: windows
service: security
definition: 'Requirements: SACLs must be enabled for "READ_CONTROL" on the registry keys used in this rule'
detection:
selection:
EventID: 4663
ObjectName|contains|all:
- \SYSTEM\
- ControlSet\Services\
AccessList|contains: "%%1538"
condition: selection
falsepositives:
- Likely from legitimate applications reading their key. Requires heavy tuning
level: low
license: DRL-1.1
related:
- id: 11d00fff-5dc3-428c-8184-801f292faec0
type: derived