Rule Info
Tags
attack.persistence attack.privilege_escalation DEMO attack.defense_evasion attack.t1574.011
Modified
None
Author
Nasreddine Bencherchali (Nextron Systems)
Name
Service Security Descriptor Tampering Via Sc.EXE
Description
Detection of sc.exe utility adding a new service with special permission which hides that service.
Date
2023-02-28 00:00:00
Id
98c5aeef-32d5-492f-b174-64a691896d25
Type
Community Rule
Link to Public Repo
Rule History
Commit
Date
Author
Title
Scan your endpoints, forensic images or collected files with our portable scanner THOR