T1574.011ExecutionStealth
Services Registry Permissions Weakness
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
11 Sigma rules tagged T1574.011Services Registry Permissions WeaknessT1574.01111 general rules
- Abuse of Service Permissions to Hide Services Via Set-Servicehightest
- Abuse of Service Permissions to Hide Services Via Set-Service - PShightest
- Possible Privilege Escalation via Weak Service Permissionshightest
- Potential Privilege Escalation via Service Permissions Weaknesshightest
- Service DACL Abuse To Hide Services Via Sc.EXEhightest
- Suspicious Service DACL Modification Via Set-Service Cmdlet - PShightest
- Changing Existing Service ImagePath Value Via Reg.EXEmediumtest
- Potential Persistence Attempt Via Existing Service Tamperingmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Services Registry Permissions Weakness
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.