Possible Privilege Escalation via Weak Service Permissions Modification

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•15

This rule detects attempts to escalate privileges by modifying Windows service configurations using 'sc.exe' from a non-administrative context (Medium integrity level). Specifically, it looks for modifications to a service's 'binPath' (ImagePath) or 'FailureCommand', which could allow an attacker to execute arbitrary code with elevated privileges when the service starts or fails.