Windows Service ImagePath Set to User-Controlled Directory via Registry

title: Windows Service ImagePath Set to User-Controlled Directory via Registry
id: 24513b7a-c9d9-467f-abc4-71ec691bd0bb
related:
  - id: c625c4c2-515d-407f-8bb6-456f65955669
    type: obsolete
  - id: 277dc340-0540-42e7-8efb-5ff460045e07
    type: derived
status: test
description: This rule flags registry changes where a Windows service ImagePath value is updated to a path located under folders commonly user-controlled, including AppData and ProgramData. Setting the service binary location this way can allow an attacker to stage or swap executables for persistence, or trigger privilege escalation if service execution can be influenced. It relies on telemetry that records registry key value modifications and captures the TargetObject and Details fields containing the ImagePath target.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_service_image_path_user_controlled_folder.yml
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-05-02
modified: 2024-03-25
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
  - detection.threat-hunting
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains|all:
      - ControlSet
      - \Services\
    TargetObject|endswith: \ImagePath
    Details|contains:
      - :\ProgramData\
      - \AppData\Local\
      - \AppData\Roaming\
  filter_optional_zoom:
    TargetObject|contains: \Services\ZoomCptService
    Details|contains: C:\Program Files\Common Files\Zoom\Support\CptService.exe
  filter_optional_mbami:
    TargetObject|contains: \Services\MBAMInstallerService
    Details|contains|all:
      - C:\Users\
      - AppData\Local\Temp\MBAMInstallerService.exe
  filter_main_windefend:
    TargetObject|contains:
      - \Services\WinDefend\
      - \Services\MpKs
    Details|contains: C:\ProgramData\Microsoft\Windows Defender\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1