
title: Modification Of Existing Services For Persistence
author: Sreeman
date: 2020/09/29
description: Detects modification of an existing service on a compromised host in
  order to execute an arbitrary payload when the service is started or killed as a
  method of persistence.
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine|re: (?i)sc config.*binpath=.*
  SELECTION_3:
    CommandLine|re: (?i)sc failure.*command=.*
  SELECTION_4:
    CommandLine|re: (?i).*reg add.*(FailureCommand|ImagePath).*(\.sh|\.exe|\.dll|\.bin$|\.bat|\.cmd|\.js|\.msh$|\.reg$|\.scr|\.ps|\.vb|\.jar|\.pl).*
  condition: (SELECTION_1 and (SELECTION_2 or SELECTION_3 or SELECTION_4))
falsepositives:
- unknown
id: 38879043-7e1e-47a9-8d46-6bec88e201df
level: medium
logsource:
  category: process_creation
  product: windows
modified: 2021/08/10
references:
- https://pentestlab.blog/2020/01/22/persistence-modify-existing-service/
status: experimental
tags:
- attack.persistence
- attack.t1031
- attack.t1543.003
- attack.t1058
- attack.t1574.011
ruletype: SIGMA
