Abuse of Service Permissions to Hide Services via Set-Service

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects the use of the "Set-Service" PowerShell cmdlet to modify a service's Security Descriptor Definition Language (SDDL) to hide the service from standard enumeration utilities like "sc.exe" or "Get-Service". This technique leverages specific SDDL flags (DCLCWPDTSD) to restrict access and visibility, primarily effective in PowerShell 7 environments.