Service DACL Abuse to Hide Services via Sc.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the use of the 'sc.exe' utility to modify service DACLs (Discretionary Access Control Lists) by adding specific permissions ('DCLCWPDTSD'). This technique is often used by threat actors to hide services, making them unremovable and persistent, thereby achieving defense evasion, persistence, and privilege escalation.