Potential Privilege Escalation via Service Registry Permissions Weakness

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

Detects attempts to modify critical service configuration registry keys (ImagePath, FailureCommand, and ServiceDll) by processes running with a 'Medium' integrity level. This activity can indicate a privilege escalation attempt where an attacker with medium integrity tries to alter service execution to gain higher privileges or establish persistence.