ServiceDll Hijack

 1title: ServiceDll Hijack
 2id: 612e47e9-8a59-43a6-b404-f48683f45bd6
 3status: test
 4description: |
 5    Detects changes to the "ServiceDLL" value related to a service in the registry.
 6    This is often used as a method of persistence.    
 7references:
 8    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md#atomic-test-4---tinyturla-backdoor-service-w64time
 9    - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
10author: frack113
11date: 2022-02-04
12modified: 2026-08-31
13tags:
14    - attack.persistence
15    - attack.privilege-escalation
16    - attack.t1543.003
17logsource:
18    category: registry_set
19    product: windows
20detection:
21    selection:
22        TargetObject|contains|all:
23            - '\System\'
24            - 'ControlSet'
25            - '\Services\'
26        TargetObject|endswith: '\Parameters\ServiceDll'
27    filter_main_printextensionmanger_1:
28        Details: 'C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll'
29    filter_main_printextensionmanger_2:
30        Image|endswith: '\regsvr32.exe'
31        TargetObject|endswith: '\Services\PrintNotify\Parameters\ServiceDll'
32        Details|startswith: 'C:\WINDOWS\System32\DriverStore\FileRepository\'
33        Details|endswith: '\arm64\PrintConfig.dll'
34    filter_main_domain_controller:
35        Image: 'C:\Windows\system32\lsass.exe'
36        TargetObject|endswith: '\Services\NTDS\Parameters\ServiceDll'
37        Details: '%%systemroot%%\system32\ntdsa.dll'
38    filter_main_poqexec:
39        Image: 'C:\Windows\System32\poqexec.exe'
40    filter_optional_safetica:
41        Image|endswith: '\regsvr32.exe'
42        Details: 'C:\Windows\System32\STAgent.dll'
43    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
44falsepositives:
45    - Administrative scripts
46    - Installation of a service
47level: medium
48simulation:
49    - type: atomic-red-team
50      name: TinyTurla backdoor service w64time
51      technique: T1543.003
52      atomic_guid: ef0581fd-528e-4662-87bc-4c2affb86940