Service Registry Permission Weakness Enumeration

Adversaries often attempt to gain persistence or elevate privileges by hijacking the configuration of Windows services. By exploiting weak Access Control Lists (ACLs) on service registry keys located at HKLM\SYSTEM\CurrentControlSet\Services, an attacker can modify the 'ImagePath' parameter to point to a malicious binary or script. When the service starts or restarts, the system executes the attacker-controlled code, often with SYSTEM or local service-level privileges. To identify these vulnerable targets, attackers use PowerShell commands, specifically Get-Acl, to enumerate the security descriptors of these registry keys. Defenders should monitor for reconnaissance activity that targets these specific service registry paths, as it often precedes an attempt to modify them for lateral movement or persistence.

Attack Chain

1. Attacker establishes initial access on a Windows endpoint.
2. Attacker executes PowerShell scripts to enumerate service registry configurations.
3. Attacker uses the Get-Acl cmdlet targeting HKLM\SYSTEM\CurrentControlSet\Services to identify weak registry permissions.
4. Attacker identifies a service registry key where the 'Authenticated Users' or local user group has write/modify access.
5. Attacker modifies the 'ImagePath' registry value within the vulnerable key to point to a malicious payload.
6. Attacker triggers a service restart or waits for a system reboot to execute the malicious binary.
7. Malicious code executes in the context of the service, resulting in privilege escalation or persistent access.

Impact

Successful exploitation allows attackers to execute arbitrary code with elevated privileges, potentially resulting in full system compromise, exfiltration of sensitive data, or the installation of persistent backdoors within the organization's infrastructure.

Recommendation

• Deploy the provided Sigma rule to detect PowerShell-based enumeration of service registry ACLs.
• Enable PowerShell Script Block Logging (Event ID 4104) to ensure visibility into the commands executed by potential attackers.
• Audit registry permissions on HKLM\SYSTEM\CurrentControlSet\Services to ensure that standard users do not have write or modify access to service configuration keys.
• Implement monitoring for modifications to the ImagePath registry value within the Services hive.