New Service Creation Using Sc.EXE

 1title: New Service Creation Using Sc.EXE
 2id: 85ff530b-261d-48c6-a441-facaa2e81e48
 3related:
 4    - id: c02e96b7-c63a-4c47-bd83-4a9f74afcfb2 # Using PowerShell
 5      type: similar
 6status: test
 7description: Detects the creation of a new service using the "sc.exe" utility.
 8references:
 9    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md
10author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
11date: 2023-02-20
12modified: 2025-09-01
13tags:
14    - attack.persistence
15    - attack.privilege-escalation
16    - attack.t1543.003
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection:
22        Image|endswith: '\sc.exe'
23        CommandLine|contains|all:
24            - 'create'
25            - 'binPath'
26    filter_optional_dropbox:
27        ParentImage|startswith:
28            - 'C:\Program Files (x86)\Dropbox\Client\'
29            - 'C:\Program Files\Dropbox\Client\'
30        ParentImage|endswith: '\Dropbox.exe'
31    condition: selection and not 1 of filter_optional_*
32falsepositives:
33    - Legitimate administrator or user creates a service for legitimate reasons.
34    - Software installation
35level: low