Deny Service Access Using Security Descriptor Tampering Via Sc.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•0

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.