Suspicious Service DACL Modification Via Set-Service Cmdlet

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.