Service DACL Abuse To Hide Services Via Sc.EXE

Title: Service DACL Abuse To Hide Services Via Sc.EXE
Status: test
Description:Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.
References:
  -https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html
  -https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
  -https://twitter.com/Alh4zr3d/status/1580925761996828672
  -https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
Author: Andreas Hunkeler (@Karneades)
Date: 2021-12-20
modified:2022-08-08
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.011'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\sc.exe' OriginalFileName:'sc.exe'   selection_cli:
    CommandLine|contains|all:
      -'sdset'
      -'DCLCWPDTSD'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high