Suspicious Service DACL Modification Via Set-Service Cmdlet

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•0

Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable