Sc-Exe - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/sc-exe/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 01 Sep 2026 12:24:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgService Security Descriptor Tampering via Sc.exehttps://feed.craftedsignal.io/briefs/2026-09-sc-sdset-tampering/Tue, 01 Sep 2026 12:24:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-sc-sdset-tampering/Adversaries can exploit the Windows 'sc.exe' utility to modify service Discretionary Access Control Lists (DACLs) via the 'sdset' command, facilitating privilege escalation and persistence by granting unauthorized service access.Adversaries often use the Windows Service Control utility (sc.exe) to maintain persistence or escalate privileges by manipulating service security descriptors. By utilizing the 'sdset' command, an attacker can modify the Discretionary Access Control List (DACL) of a target service, allowing them to assign broad or specific access rights to arbitrary users or security principals. This technique is particularly effective for granting 'everyone' or specific logon users (such as interactive users or service accounts) control over sensitive system services. Because this activity requires legitimate administrative or SYSTEM privileges, it is frequently observed during the post-compromise stage of an intrusion to ensure continued access or to bypass service-level restrictions. Defenders should monitor for sc.exe command lines that incorporate Security Descriptor Definition Language (SDDL) strings designed to explicitly permit new access rights.

Impact

Successful manipulation of service security descriptors allows an attacker to gain control over high-privilege services, leading to unauthorized code execution as SYSTEM. This technique can be used to reconfigure services to run malicious binaries or to modify the behavior of existing services, effectively bypassing standard Windows service security hardening.

Recommendation

Deploy the provided Sigma rule to detect suspicious use of 'sc.exe sdset'. Prioritize monitoring for administrative commands that modify DACLs, especially those referencing wide-access principals like 'Everyone' (WD) or 'Interactive Users' (IU). Enable Sysmon Event ID 1 (Process Creation) to capture the full command-line arguments, as these are required to inspect the SDDL string.

]]>highadvisoryprivilege-escalationpersistencewindowssecurity-descriptorsc-exe