Deny Service Access Using Security Descriptor Tampering Via Sc.EXE

Title: Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
Status: test
Description:Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.
References:
  -https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
  -https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
  -https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
Author: Jonhnathan Ribeiro, oscd.community
Date: 2020-10-16
modified:2023-02-28
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1543.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_sc:
Image|endswith:'\sc.exe' OriginalFileName:'sc.exe'   selection_sdset:
    CommandLine|contains|all:
      -'sdset'
      -'D;'

  selection_trustee:
    CommandLine|contains:
      -';IU'
      -';SU'
      -';BA'
      -';SY'
      -';WD'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high