Service Registry Key Read Access Request

Title: Service Registry Key Read Access Request
Status: test
Description:Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
References:
  -https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
Author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
Date: 2023-09-28
modified:None
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.011'

Logsource:

• product: windows
• service: security
• definition: Requirements: SACLs must be enabled for "READ_CONTROL" on the registry keys used in this rule

Detection:
  selection:
    EventID: '4663'
    ObjectName|contains|all:
      -'\SYSTEM\'
      -'ControlSet\Services\'

    AccessList|contains: '%%1538'
  condition:selection
Falsepositives:
  -Likely from legitimate applications reading their key. Requires heavy tuning
Level: low