Configure Failure Action For Service Via Sc.EXE

Rule Info

Name
Configure Failure Action For Service Via Sc.EXE
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the execution of the "sc.exe" utility with the "failure" flag in order to configure failure action or command to be executed. Attackers might configure a specific service failure action or command in order to keep persistence on a machine.
Reference
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742019(v=ws.11)
Date
2024-04-29 00:00:00
Modified
None
Id
9ba507ec-67c0-46f2-9b72-bd9e65b497f8
Tags
attack.defense_evasion
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022