Suspicious Modification of Service Control Manager Permissions Via Sc.EXE

Florian Roth

Detects changes to the Service Control Manager (SCManager) security descriptor that grant excessive permissions (e.g., Everyone group) to control system services. This behavior can indicate an attempt at local privilege escalation by allowing unauthorized users to manipulate critical services.

2024-09-19 00:00:00

None

5653d2da-b52d-49f5-ba03-6030902bd1ce

attack.privilege-escalation

Nextron Sigma feed only (private)