Query: rule covering Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"
Matching passage: Sigma rule: Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual". Logsource: windows / process_creation. Rule: title: Service StartupType Change Via PowerShell Set-Service id: 62b20d44-1546-4e61-afce-8e175eb9473c status: test description: Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual" references: - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-04 tags: - attack.execution - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \powershell.exe - OriginalFileName: PowerShell.EXE selection_cli: CommandLine|contains|all: - Set-Service - -StartupType CommandLine|contains: - Disabled - Manual condition: all of selection_* falsepositives: - False positives may occur with troubleshooting scripts level: medium
Near-miss passage: Sigma rule: Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a. Logsource: windows / process_creation. Rule: title: Elevated System Shell Spawned From Uncommon Parent Location id: 178e615d-e666-498b-9630-9ed363038101 related: - id: 61065c72-5d7d-44ef-bf41-6a36684b545f type: similar status: test description: Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location. references: - https://github.com/Wh04m1001/SysmonEoP author: frack113, Tim Shelton (update fp) date: 2022-12-05 modified: 2025-03-06 tags: - attack.privilege-escalation - attack.execution - attack.t1059 logsource: product: windows category: process_creation detection: selection_shell: - Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \cmd.exe - OriginalFileName: - PowerShell.EXE - powershell_ise.EXE - pwsh.dll - Cmd.Exe selection_user: User|contains: - AUTHORI - AUTORI LogonId: '0x3e7' filter_main_generic: ParentImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\ProgramData\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\Temp\ - :\Windows\WinSxS\ filter_optional_manageengine: ParentImage|endswith: :\ManageEngine\ADManager Plus\pgsql\bin\postgres.exe Image|endswith: \cmd.exe filter_optional_asgard: CommandLine|contains: :\WINDOWS\system32\cmd.exe /c " CurrentDirectory|contains: :\WINDOWS\Temp\asgard2-agent\ filter_optional_ibm_spectrumprotect: ParentImage|contains: :\IBM\SpectrumProtect\webserver\scripts\ CommandLine|contains: :\IBM\SpectrumProtect\webserver\scripts\ filter_main_parent_null: ParentImage: null filter_main_parent_empty: ParentImage: - '' - '-' condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some legitimate applications may spawn shells from uncommon parent locations. Apply additional filters and perform an initial baseline before deploying. level: medium