Query: detect Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to overri in logs
Matching passage: Sigma rule: Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to overri. Logsource: windows / process_creation. Rule: title: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE id: 6c8fbee5-dee8-49bc-851d-c3142d02aa47 related: - id: a537cfc3-4297-4789-92b5-345bfd845ad0 type: similar status: test description: Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs. references: - https://twitter.com/0gtweet/status/1628720819537936386 - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-28 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_sc: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_sdset: CommandLine|contains|all: - sdset - A; selection_trustee: CommandLine|contains: - ;IU - ;SU - ;BA - ;SY - ;WD filter_optional_hexnode: ParentImage: C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for ap. Logsource: windows / file_event. Rule: title: Legitimate Application Writing Files In Uncommon Location id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67 related: - id: 2ddef153-167b-4e89-86b6-757a9e65dcac type: similar status: experimental description: 'Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution. Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions. ' references: - https://lolbas-project.github.io/#/download author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-10 tags: - attack.stealth - attack.t1218 - attack.command-and-control - attack.t1105 logsource: product: windows category: file_event detection: selection_img: Image|endswith: - \eqnedt32.exe - \wordpad.exe - \wordview.exe - \cmdl32.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \bitsadmin.exe - \Desktopimgdownldr.exe - \esentutl.exe - \expand.exe - \extrac32.exe - \replace.exe - \mshta.exe - \ftp.exe - \Ldifde.exe - \RdrCEF.exe - \hh.exe - \finger.exe - \findstr.exe selection_locations: TargetFilename|contains: - :\Perflogs - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\ - \$Recycle.Bin\ - \AppData\Local\ - \AppData\Roaming\ - \Contacts\ - \Desktop\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location/info.yml