Detection rules › Sigma

Allow Service Access Using Security Descriptor Tampering Via Sc.EXE

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1543.003 Create or Modify System Process: Windows Service
Privilege EscalationT1543.003 Create or Modify System Process: Windows Service

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_sc

or:
Image|endswith: '\sc.exe'
OriginalFileName: sc.exe

Stage 2: all of selection_sdset

CommandLine|contains: 'A;'
CommandLine|contains: sdset

Stage 3: all of selection_trustee

or:
CommandLine|contains: ';BA'
CommandLine|contains: ';IU'
CommandLine|contains: ';SU'
CommandLine|contains: ';SY'
CommandLine|contains: ';WD'

Stage 4: not 1 of filter_optional_hexnode

ParentImage: 'C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • ;BA corpus 2 (sigma 2)
  • ;IU corpus 2 (sigma 2)
  • ;SU corpus 2 (sigma 2)
  • ;SY corpus 2 (sigma 2)
  • ;WD corpus 2 (sigma 2)
  • A;
  • sdset corpus 4 (sigma 4)
Imageends_with
  • \sc.exe corpus 17 (sigma 17)
OriginalFileNameeq
  • sc.exe corpus 10 (sigma 10)
ParentImageeq
  • C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe