Windows Security 4663 Detects Read Control (READ_CONTROL) Access to Service Registry Keys

title: Windows Security 4663 Detects Read Control (READ_CONTROL) Access to Service Registry Keys
id: 1120db92-0ec0-4ec7-ad69-1e5bec310376
status: test
description: This rule matches Windows Security Event ID 4663 for object access requests targeting registry paths under \SYSTEM\ControlSet\Services\ with an access mask containing %%1538 (READ_CONTROL). Attackers may query and abuse service-related registry permissions to redirect service behavior by manipulating how services resolve executables or associated configuration. The detection relies on SACL-enabled registry auditing telemetry that records the requested access rights for the target registry key.
references:
  - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_registry_permissions_weakness_check.yml
author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team, Huntrule Team
date: 2023-09-28
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.011
logsource:
  product: windows
  service: security
  definition: 'Requirements: SACLs must be enabled for "READ_CONTROL" on the registry keys used in this rule'
detection:
  selection:
    EventID: 4663
    ObjectName|contains|all:
      - \SYSTEM\
      - ControlSet\Services\
    AccessList|contains: "%%1538"
  condition: selection
falsepositives:
  - Likely from legitimate applications reading their key. Requires heavy tuning
level: low
license: DRL-1.1
related:
  - id: 11d00fff-5dc3-428c-8184-801f292faec0
    type: derived