{"id":"T1574.011","name":"Services Registry Permissions Weakness","url":"https://attack.mitre.org/techniques/T1574/011","tactics":["stealth","execution"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0427","stix_id":"x-mitre-detection-strategy--a44e6677-25d9-495a-91fd-e2611dac9477","name":"Detection Strategy for Hijack Execution Flow through Service Registry Premission Weakness.","url":"https://attack.mitre.org/detectionstrategies/DET0427","analytics":[{"id":"AN1195","stix_id":"x-mitre-analytic--43f5598c-5c63-40f4-b936-2978bd0f3aa0","name":"Analytic 1195","description":"Unauthorized modification of service-related registry keys such as ImagePath, FailureCommand, ServiceDll, or Performance/Parameters keys. Defender correlates registry modifications, anomalous service metadata changes, and subsequent service process executions that deviate from baseline configurations.","url":"https://attack.mitre.org/detectionstrategies/DET0427#AN1195","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4657","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:System","channel":"EventCode=7040","data_component":"DC0065","data_component_name":"Service Modification","log_source_slug":"wineventlog-system"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"MonitoredServiceKeys","description":"Registry subkeys for critical services (ImagePath, ServiceDll, FailureCommand, Parameters)."},{"field":"BaselineServiceConfig","description":"Known good service registry configurations and paths for comparison."},{"field":"TimeWindow","description":"Correlation interval between registry/service modifications and service execution."},{"field":"PrivilegedAccounts","description":"Accounts permitted to modify service configurations."}],"live":true,"detection_strategies":["DET0427"],"techniques":["T1574.011"]}],"live":true,"version":"1.0","techniques":["T1574.011"]}],"sigma_rules":[{"id":"0f9c21f1-6a73-4b0e-9809-cb562cb8d981","title":"Potential Privilege Escalation via Service Permissions Weakness","author":"Teymur Kheirkhabarov","status":"test","level":"high","date":"2019-10-26","modified":"2024-12-01","description":"Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level","references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment","https://pentestlab.blog/2017/03/31/insecure-registry-permissions/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.011"],"path":"rules/windows/process_creation/proc_creation_win_registry_privilege_escalation_via_service_key.yml","techniques":["T1574.011"],"cves":[]},{"id":"11d00fff-5dc3-428c-8184-801f292faec0","title":"Service Registry Key Read Access Request","author":"Center for Threat Informed Defense (CTID) Summiting the Pyramid Team","status":"test","level":"low","date":"2023-09-28","modified":null,"description":"Detects \"read access\" requests on the services registry key.\nAdversaries may execute their own malicious payloads by hijacking the Registry entries used by services.\nAdversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.\n","references":["https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness"],"logsource":{"product":"windows","service":"security"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.011"],"path":"rules/windows/builtin/security/win_security_registry_permissions_weakness_check.yml","techniques":["T1574.011"],"cves":[]},{"id":"22d80745-6f2c-46da-826b-77adaededd74","title":"Suspicious Service DACL Modification Via Set-Service Cmdlet - PS","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-10-24","modified":null,"description":"Detects usage of the \"Set-Service\" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as \"sc.exe\", \"Get-Service\"...etc. (Works only in powershell 7)","references":["https://twitter.com/Alh4zr3d/status/1580925761996828672","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.011"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_service_dacl_modification_set_service.yml","techniques":["T1574.011"],"cves":[]},{"id":"38879043-7e1e-47a9-8d46-6bec88e201df","title":"Potential Persistence Attempt Via Existing Service Tampering","author":"Sreeman","status":"test","level":"medium","date":"2020-09-29","modified":"2023-02-04","description":"Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.","references":["https://pentestlab.blog/2020/01/22/persistence-modify-existing-service/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1543.003","attack.t1574.011"],"path":"rules/windows/process_creation/proc_creation_win_sc_service_tamper_for_persistence.yml","techniques":["T1543.003","T1574.011"],"cves":[]},{"id":"514e4c3a-c77d-4cde-a00f-046425e2301e","title":"Abuse of Service Permissions to Hide Services Via Set-Service","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-10-17","modified":null,"description":"Detects usage of the \"Set-Service\" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as \"sc.exe\", \"Get-Service\"...etc. (Works only in powershell 7)","references":["https://twitter.com/Alh4zr3d/status/1580925761996828672","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.011"],"path":"rules/windows/process_creation/proc_creation_win_powershell_hide_services_via_set_service.yml","techniques":["T1574.011"],"cves":[]},{"id":"953945c5-22fe-4a92-9f8a-a9edc1e522da","title":"Abuse of Service Permissions to Hide Services Via Set-Service - PS","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-10-17","modified":null,"description":"Detects usage of the \"Set-Service\" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as \"sc.exe\", \"Get-Service\"...etc. (Works only in powershell 7)","references":["https://twitter.com/Alh4zr3d/status/1580925761996828672","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.011"],"path":"rules/windows/powershell/powershell_script/posh_ps_using_set_service_to_hide_services.yml","techniques":["T1574.011"],"cves":[]},{"id":"95afc12e-3cbb-40c3-9340-84a032e596a3","title":"Service Registry Permissions Weakness Check","author":"frack113","status":"test","level":"medium","date":"2021-12-30","modified":null,"description":"Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.\nAdversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.\nWindows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1574.011","stp.2a"],"path":"rules/windows/powershell/powershell_script/posh_ps_get_acl_service.yml","techniques":["T1574.011"],"cves":[]},{"id":"98c5aeef-32d5-492f-b174-64a691896d25","title":"Service Security Descriptor Tampering Via Sc.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-28","modified":null,"description":"Detection of sc.exe utility adding a new service with special permission which hides that service.","references":["https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html","https://www.sans.org/blog/red-team-tactics-hiding-windows-services/","https://twitter.com/Alh4zr3d/status/1580925761996828672","https://twitter.com/0gtweet/status/1628720819537936386","https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.011"],"path":"rules/windows/process_creation/proc_creation_win_sc_sdset_modification.yml","techniques":["T1574.011"],"cves":[]},{"id":"9b0b7ac3-6223-47aa-a3fd-e8f211e637db","title":"Changing Existing Service ImagePath Value Via Reg.EXE","author":"frack113","status":"test","level":"medium","date":"2021-12-30","modified":"2024-03-13","description":"Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.\nAdversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.\nWindows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1574.011"],"path":"rules/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml","techniques":["T1574.011"],"cves":[]},{"id":"a537cfc3-4297-4789-92b5-345bfd845ad0","title":"Service DACL Abuse To Hide Services Via Sc.EXE","author":"Andreas Hunkeler (@Karneades)","status":"test","level":"high","date":"2021-12-20","modified":"2022-08-08","description":"Detects usage of the \"sc.exe\" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.","references":["https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html","https://www.sans.org/blog/red-team-tactics-hiding-windows-services/","https://twitter.com/Alh4zr3d/status/1580925761996828672","https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.011"],"path":"rules/windows/process_creation/proc_creation_win_sc_sdset_hide_sevices.yml","techniques":["T1574.011"],"cves":[]},{"id":"d937b75f-a665-4480-88a5-2f20e9f9b22a","title":"Possible Privilege Escalation via Weak Service Permissions","author":"Teymur Kheirkhabarov","status":"test","level":"high","date":"2019-10-26","modified":"2024-12-01","description":"Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand","references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment","https://pentestlab.blog/2017/03/30/weak-service-permissions/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.011"],"path":"rules/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml","techniques":["T1574.011"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}