detection.wiki

Detection rules › Sigma

Suspicious Service DACL Modification Via Set-Service Cmdlet - PS

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1574.011 Hijack Execution Flow: Services Registry Permissions Weakness
Privilege EscalationT1574.011 Hijack Execution Flow: Services Registry Permissions Weakness
Defense EvasionT1574.011 Hijack Execution Flow: Services Registry Permissions Weakness

Event coverage

ProviderEvent IDTitle
PowerShell4104Creating Scriptblock text (MessageNumber of MessageTotal).

Stages and Predicates

Stage 1: all of selection_sddl_flag

or:
ScriptBlockText|contains: '-SecurityDescriptorSddl '
ScriptBlockText|contains: '-sd '

Stage 2: all of selection_set_service

or:
ScriptBlockText|contains: ';;;BA'
ScriptBlockText|contains: ';;;IU'
ScriptBlockText|contains: ';;;SU'
ScriptBlockText|contains: ';;;SY'
ScriptBlockText|contains: ';;;WD'
ScriptBlockText|contains: 'D;;'
ScriptBlockText|contains: 'Set-Service '

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ScriptBlockTextmatch
  • -SecurityDescriptorSddl corpus 2 (sigma 2)
  • -sd corpus 2 (sigma 2)
  • ;;;BA
  • ;;;IU
  • ;;;SU
  • ;;;SY
  • ;;;WD
  • D;;
  • Set-Service corpus 2 (sigma 2)

Neighbors

Stricter alternatives (narrower than this rule)

The rules below may be useful if you find the current rule is too noisy / lacks specificity.

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.