Service Security Descriptor Tampering via Sc.exe

Adversaries often use the Windows Service Control utility (sc.exe) to maintain persistence or escalate privileges by manipulating service security descriptors. By utilizing the 'sdset' command, an attacker can modify the Discretionary Access Control List (DACL) of a target service, allowing them to assign broad or specific access rights to arbitrary users or security principals. This technique is particularly effective for granting 'everyone' or specific logon users (such as interactive users or service accounts) control over sensitive system services. Because this activity requires legitimate administrative or SYSTEM privileges, it is frequently observed during the post-compromise stage of an intrusion to ensure continued access or to bypass service-level restrictions. Defenders should monitor for sc.exe command lines that incorporate Security Descriptor Definition Language (SDDL) strings designed to explicitly permit new access rights.

Impact

Successful manipulation of service security descriptors allows an attacker to gain control over high-privilege services, leading to unauthorized code execution as SYSTEM. This technique can be used to reconfigure services to run malicious binaries or to modify the behavior of existing services, effectively bypassing standard Windows service security hardening.

Recommendation

Deploy the provided Sigma rule to detect suspicious use of 'sc.exe sdset'. Prioritize monitoring for administrative commands that modify DACLs, especially those referencing wide-access principals like 'Everyone' (WD) or 'Interactive Users' (IU). Enable Sysmon Event ID 1 (Process Creation) to capture the full command-line arguments, as these are required to inspect the SDDL string.