Possible Privilege Escalation via Weak Service Permissions

calendar Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.execution attack.stealth attack.t1574.011  ·
Share on: linkedin copy

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Sigma rule (View on GitHub)

 1title: Possible Privilege Escalation via Weak Service Permissions
 2id: d937b75f-a665-4480-88a5-2f20e9f9b22a
 3status: test
 4description: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand
 5references:
 6    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
 7    - https://pentestlab.blog/2017/03/30/weak-service-permissions/
 8author: Teymur Kheirkhabarov
 9date: 2019-10-26
10modified: 2024-12-01
11tags:
12    - attack.persistence
13    - attack.privilege-escalation
14    - attack.execution
15    - attack.stealth
16    - attack.t1574.011
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    scbynonadmin:
22        Image|endswith: '\sc.exe'
23        IntegrityLevel:
24            - 'Medium'
25            - 'S-1-16-8192'
26    selection_binpath:
27        CommandLine|contains|all:
28            - 'config'
29            - 'binPath'
30    selection_failure:
31        CommandLine|contains|all:
32            - 'failure'
33            - 'command'
34    condition: scbynonadmin and 1 of selection_*
35falsepositives:
36    - Unknown
37level: high

References

Related rules

to-top