Abuse of Service Permissions to Hide Services Via Set-Service - PS

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)