Non-privileged Service Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•19

This rule detects attempts by non-privileged users (IntegrityLevel: Medium or S-1-16-8192) to modify Windows service configurations in the registry. It specifically looks for command-line executions of 'reg' with 'add' or 'powershell' with 'set-itemproperty', 'sp', or 'new-itemproperty' that target service-related registry paths (containing 'ControlSet' and 'Services') and modify critical service parameters like 'ImagePath', 'FailureCommand', or 'ServiceDLL'. This activity could indicate an attempt to establish persistence or elevate privileges by hijacking service execution.