Abuse of Service Permissions to Hide Services Via Set-Service - PS

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects the use of the PowerShell 'Set-Service' cmdlet to modify a service's security descriptor (SDDL) to include 'DCLCWPDTSD'. This specific SDDL string is known to hide services from common utilities like 'sc.exe' and 'Get-Service', effectively making them invisible. This technique is primarily effective in PowerShell 7 and later versions.