Service Access Tampering via Sc.EXE sdset

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•15

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee using 'sc.exe sdset'. This technique can be used by adversaries for privilege escalation or persistence by overriding existing access restrictions on Windows services.