Service Security Descriptor Tampering Via Sc.EXE

Title: Service Security Descriptor Tampering Via Sc.EXE
Status: test
Description:Detection of sc.exe utility adding a new service with special permission which hides that service.
References:
  -https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html
  -https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
  -https://twitter.com/Alh4zr3d/status/1580925761996828672
  -https://twitter.com/0gtweet/status/1628720819537936386
  -https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-28
modified:None
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.011'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\sc.exe' OriginalFileName:'sc.exe'   selection_cli:
    CommandLine|contains: 'sdset'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium