Insecure Service Binary ACL
This detection identifies Windows service installations (Event ID 4697) where potentially dangerous permissions like Everyone:Full Control or Authenticated Users:Full Control may be assigned to the service executable. Such configurations can lead to privilege escalation via service binary hijacking. Note: Field index positions in EventData.Data[] may vary depending on the system and must be manually verified using parse_xml(EventData). This detection requires the following audit subcategory to be enabled: Audit Policy: Audit Kernel Object (under Object Access)
Microsoft Sentinel (KQL)
