Interesting Service Enumeration Via Sc.EXE

Status: test
Severity: low
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel
Source: github.com/SigmaHQ/sigma

Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003` OS Credential Dumping

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Interesting Service Enumeration Via Sc.EXE
id: e83e8899-c9b2-483b-b355-5decc942b959
status: test
description: |
    Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
    Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
references:
    - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/
    - https://pentestlab.blog/tag/svchost/
author: Swachchhanda Shrawan Poudel
date: 2024-02-12
tags:
    - attack.t1003
    - attack.credential-access
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\sc.exe'
        - OriginalFileName: 'sc.exe'
    selection_cli:
        CommandLine|contains: 'query'
    selection_cmd:
        # Note: add more interesting services
        CommandLine|contains: 'termservice'
    condition: all of selection_*
falsepositives:
    - Unknown
# Note: can be upgraded to medium after an initial baseline
level: low

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\sc.exe'
    - OriginalFileName: 'sc.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: 'query'

Stage 3: `selection_cmd`

selection_cmd:
    CommandLine|contains: 'termservice'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`query` corpus 8 (sigma 7, splunk 1) `termservice`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\sc.exe` corpus 30 (sigma 30)	`field:"Image" kind:ends_with value:"\sc.exe"`
`OriginalFileName`	eq	`sc.exe` corpus 30 (sigma 12, splunk 10, elastic 8)	`field:"OriginalFileName" kind:eq value:"sc.exe"`