huntrule

Windows service configuration tampering via sc/reg with payload execution paths

Looks for sc/reg command-line activity that updates Windows service ImagePath or FailureCommand to run attacker-controlled payloads.

FreeUnreviewedSigmamediumv1
title: Windows service configuration tampering via sc/reg with payload execution paths
id: bd4ed5ce-1c4a-4e89-992e-1fa5e20b789b
status: test
description: This rule flags process executions that modify an existing Windows service using the sc utility (including failure command/binpath changes) and related registry edits with reg add targeting FailureCommand and ImagePath. Such tampering can establish persistence by causing an attacker-supplied command or binary path to run when the service starts, fails, or is otherwise managed. The detection relies on Windows process creation telemetry, specifically command-line content for sc and reg commands referencing service configuration and executable/script payload indicators.
references:
  - https://pentestlab.blog/2020/01/22/persistence-modify-existing-service/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_service_tamper_for_persistence.yml
author: Sreeman, Huntrule Team
date: 2020-09-29
modified: 2023-02-04
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1543.003
  - attack.t1574.011
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    - CommandLine|contains|all:
        - "sc "
        - "config "
        - binpath=
    - CommandLine|contains|all:
        - "sc "
        - failure
        - command=
  selection_reg_img:
    - CommandLine|contains|all:
        - "reg "
        - "add "
        - FailureCommand
    - CommandLine|contains|all:
        - "reg "
        - "add "
        - ImagePath
  selection_reg_ext:
    CommandLine|contains:
      - .sh
      - .exe
      - .dll
      - .bin$
      - .bat
      - .cmd
      - .js
      - .msh$
      - .reg$
      - .scr
      - .ps
      - .vb
      - .jar
      - .pl
  condition: selection_sc or all of selection_reg_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 38879043-7e1e-47a9-8d46-6bec88e201df
    type: derived

What it detects

This rule flags process executions that modify an existing Windows service using the sc utility (including failure command/binpath changes) and related registry edits with reg add targeting FailureCommand and ImagePath. Such tampering can establish persistence by causing an attacker-supplied command or binary path to run when the service starts, fails, or is otherwise managed. The detection relies on Windows process creation telemetry, specifically command-line content for sc and reg commands referencing service configuration and executable/script payload indicators.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.