Skip to content

Hide Navigation Hide TOC

Possible Privilege Escalation via Weak Service Permissions (d937b75f-a665-4480-88a5-2f20e9f9b22a)

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Cluster A Galaxy A Cluster B Galaxy B Level
Possible Privilege Escalation via Weak Service Permissions (d937b75f-a665-4480-88a5-2f20e9f9b22a) Sigma-Rules Services Registry Permissions Weakness - T1574.011 (17cc750b-e95b-4d7d-9dde-49e0de24148c) Attack Pattern 1
Services Registry Permissions Weakness - T1574.011 (17cc750b-e95b-4d7d-9dde-49e0de24148c) Attack Pattern Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) Attack Pattern 2