Rule Info
Tags
attack.persistence DEMO attack.t1543.003
Modified
None
Author
Nasreddine Bencherchali (Nextron Systems)
Name
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
Description
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.
Date
2023-02-28 00:00:00
Id
6c8fbee5-dee8-49bc-851d-c3142d02aa47
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR