huntrule

Windows service configuration tampering via sc/reg with payload execution paths

Looks for sc/reg command-line activity that updates Windows service ImagePath or FailureCommand to run attacker-controlled payloads.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Sreeman (SigmaHQ), DRL 1.1
Published
2020-09-29
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions that modify an existing Windows service using the sc utility (including failure command/binpath changes) and related registry edits with reg add targeting FailureCommand and ImagePath. Such tampering can establish persistence by causing an attacker-supplied command or binary path to run when the service starts, fails, or is otherwise managed. The detection relies on Windows process creation telemetry, specifically command-line content for sc and reg commands referencing service configuration and executable/script payload indicators.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange
Suspicious Service DLL Hijack of IKEEXT or PrintNotify
Service Hiding via SC Sdset Security Descriptor Modification
Malicious Service DLL Hijack for Persistence via Lotus Blossom
Malicious TinyTurla ServiceDll Registration via svchost Group (via registry_set)
Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe
Malicious Service Creation With Autostart binPath via sc.exe (via process_creation)
Malicious svchost Service Creation for TinyTurla Persistence (via process_creation)
Malicious Service Creation Masquerading as nslookup (via process_creation)
Interactive Service Creation Executing cmd via sc.exe
Windows service configuration tampering via sc/reg with payload execution paths
Pivot detection · T1543.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.