Deny Service Access via SC.EXE SDSET Tampering

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

Detects suspicious modifications to a Windows service's Discretionary Access Control List (DACL) using 'sc.exe' to deny access to critical trustees. This technique can be used by adversaries to hide services, make them unstoppable, or achieve persistence and privilege escalation by preventing legitimate users or administrators from managing the service.