Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
45
4
3
1
1
Contributors
25
18
3
3
2
Categories
32
12
10
10
6
Platforms
54
Products / Services
11
9
6
5
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
The following analytic detects the modification of registry keys that define Windows services using reg.exe. This detection leverages Splunk to search for specific keywords in the registry path, value name, and value data fields. This activity is significant because it indicates potential unauthorized changes to service configurations, a common persistence technique used by attackers. If confirmed malicious, this could allow an attacker to maintain access, escalate privileges, or move laterally within the network, leading to data theft, ransomware, or other damaging outcomes.
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.
Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services
Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.
Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services
Detects attempts to stop or reconfigure critical Windows security services (such as WinDefend, WscSvc, Sense, and WdNisSvc) using the Service Control Manager (sc.exe) or by modifying service registry keys via reg.exe. This behavior is indicative of an adversary attempting to disable EDR/AV solutions to evade detection.
Detection of sc.exe utility adding a new service with special permission which hides that service.
Detects the modification of the 'ServiceDLL' Registry value for a Windows service to a path that resides outside of the standard C:\Windows\System32 or C:\Windows\SysWOW64 directories. This behavior is often associated with service hijacking or persistence techniques where an adversary points a service to a malicious DLL for execution.
Detects replacement of service binaries for execution flow hijacking
This rule detects network traffic attempting to exploit a Service Registry ACL weakness remotely. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "HKLM\System\CurrentControlSet\Services" (case-insensitive) in the payload. This string is indicative of an attempt to modify or interact with Windows services via the registry, potentially leveraging weak ACLs to establish persistence or execute malicious code.
Detects exploitation of weak service registry ACLs for privilege persistence
Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)
Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.
Detects "read access" requests on the services registry key.
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)
Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.
Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services
Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.
Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services
Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level
Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand
Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.
Detects the execution of sc.exe or reg.exe to create or modify specific Windows services to point to a malicious DLL. This technique is used by the Silver Dragon APT group to hijack legitimate services like 'bthsrv' and 'wuausrv' for persistence.
Detects the setting of the "ImagePath" value of a service registry key to a path controlled by a non-administrator user such as "\AppData\" or "\ProgramData\". Attackers often use such directories for staging purposes. This rule might also trigger on badly written software, where if an attacker controls an auto starting service, they might achieve persistence or privilege escalation. Note that while ProgramData is a user controlled folder, software might apply strict ACLs which makes them only accessible to admin users. Remove such folders via filters if you experience a lot of noise.
This rule detects attempts to modify the ImagePath value of a Windows service using the 'reg.exe' utility. Adversaries may hijack existing service registry entries to execute their own malicious payloads, leveraging flaws in permissions to redirect the service's executable to one they control. This allows them to achieve persistence and potentially privilege escalation when the service starts.
This rule detects attempts by non-privileged users (IntegrityLevel: Medium or S-1-16-8192) to modify Windows service configurations in the registry. It specifically looks for command-line executions of 'reg' with 'add' or 'powershell' with 'set-itemproperty', 'sp', or 'new-itemproperty' that target service-related registry paths (containing 'ControlSet' and 'Services') and modify critical service parameters like 'ImagePath', 'FailureCommand', or 'ServiceDLL'. This activity could indicate an attempt to establish persistence or elevate privileges by hijacking service execution.
Page 1 of 3