Title:
Abuse of Service Permissions to Hide Services Via Set-Service - PS
Status:
test
Description:Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)
References:
-https://twitter.com/Alh4zr3d/status/1580925761996828672
-https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-17
modified:None
Tags:
- -'attack.persistence'
- -'attack.privilege-escalation'
- -'attack.execution'
- -'attack.stealth'
- -'attack.t1574.011'
Logsource:
- product: windows
- category: ps_script
- definition: Requirements: Script Block Logging must be enabled
Detection:
selection:
ScriptBlockText|contains|all:
-'Set-Service '
-'DCLCWPDTSD'
ScriptBlockText|contains:
-'-SecurityDescriptorSddl '
-'-sd '
condition:
selection
Falsepositives:
-Rare intended use of hidden services
-Rare FP could occur due to the non linearity of the ScriptBlockText log
Level:
high
