PowerShell Get-Acl on Service Registry Keys

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•15

This rule detects PowerShell scripts that attempt to retrieve Access Control Lists (ACLs) for service-related registry keys under HKLM\SYSTEM\CurrentControlSet\Services. This activity could indicate an adversary performing reconnaissance for service registry permissions weaknesses, which can be exploited for privilege escalation or persistence. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services if permissions are misconfigured.