Rule Info
Name
Service Permissions Change via SC.EXE
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects attempts to modify service permissions using sc.exe command with privs parameter
Date
2025-09-17 00:00:00
Modified
None
Id
2a3e36a3-d35f-43b8-9c8e-80256367140b
Tags
attack.persistence attack.privilege-escalation attack.t1543.003
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR