Interesting Service Enumeration Via Sc.EXE

testlow

log source: windows · process_creationauthor Swachchhanda Shrawan Poudeldate 2024-02-12

description

What this is, in brief.

Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.

rule source (YAML)

title: Interesting Service Enumeration Via Sc.EXE
id: e83e8899-c9b2-483b-b355-5decc942b959
status: test
description: |
    Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
    Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
references:
    - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/
    - https://pentestlab.blog/tag/svchost/
author: Swachchhanda Shrawan Poudel
date: 2024-02-12
tags:
    - attack.t1003
    - attack.credential-access
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\sc.exe'
        - OriginalFileName: 'sc.exe'
    selection_cli:
        CommandLine|contains: 'query'
    selection_cmd:
        # Note: add more interesting services
        CommandLine|contains: 'termservice'
    condition: all of selection_*
falsepositives:
    - Unknown
# Note: can be upgraded to medium after an initial baseline
level: low

detects techniques (1)

ATT&CK techniques this enables or maps to.

T1003OS Credential Dumping

references

External citations — patches, advisories, analysis.