Service StartupType Change Via Sc.EXE

Title: Service StartupType Change Via Sc.EXE
Status: test
Description:Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand"
References:
  -https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-01
modified:2023-03-04
Tags:

• -'attack.execution'
• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\sc.exe' OriginalFileName:'sc.exe'   selection_cli:
    CommandLine|contains|all:
      -' config '
      -'start'

    CommandLine|contains:
      -'disabled'
      -'demand'

  condition:all of selection_*
Falsepositives:
  -False positives may occur with troubleshooting scripts
Level: medium