Query: detection rule: Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which make
Matching passage: Sigma rule: Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which make. Logsource: windows / process_creation. Rule: title: Service DACL Abuse To Hide Services Via Sc.EXE id: a537cfc3-4297-4789-92b5-345bfd845ad0 related: - id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 type: similar - id: 98c5aeef-32d5-492f-b174-64a691896d25 type: similar status: test description: Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable. references: - https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://twitter.com/Alh4zr3d/status/1580925761996828672 - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ author: Andreas Hunkeler (@Karneades) date: 2021-12-20 modified: 2022-08-08 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_cli: CommandLine|contains|all: - sdset - DCLCWPDTSD condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In Po. Logsource: windows / process_creation. Rule: title: RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class id: 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d related: - id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b type: similar status: experimental description: 'Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose. ' references: - https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html - https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall - https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468 author: Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-15 tags: - attack.lateral-movement - attack.t1021.001 - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \wmic.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - wmic.exe - PowerShell.EXE - pwsh.dll selection_cli_method: CommandLine|contains: - rdtoggle - Win32_TerminalServiceSetting selection_cli_property: CommandLine|contains: SetAllowTSConnections condition: all of selection_* falsepositives: - Legitimate system administrators enabling RDP for remote support - System configuration scripts during deployment level: medium