detection.wiki

Detection rules › Sigma

Service Binary in User Controlled Folder

Status
test
Severity
medium
Log source
product windows, category registry_set
Author
Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the setting of the "ImagePath" value of a service registry key to a path controlled by a non-administrator user such as "\AppData" or "\ProgramData". Attackers often use such directories for staging purposes. This rule might also trigger on badly written software, where if an attacker controls an auto starting service, they might achieve persistence or privilege escalation. Note that while ProgramData is a user controlled folder, software might apply strict ACLs which makes them only accessible to admin users. Remove such folders via filters if you experience a lot of noise.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry
Defense ImpairmentT1112 Modify Registry

Event coverage

ProviderEventTitle
SysmonEvent ID 13RegistryEvent (Value Set)

Rule body yaml

title: Service Binary in User Controlled Folder
id: 277dc340-0540-42e7-8efb-5ff460045e07
related:
    - id: c625c4c2-515d-407f-8bb6-456f65955669
      type: obsolete
status: test
description: |
    Detects the setting of the "ImagePath" value of a service registry key to a path controlled by a non-administrator user such as "\AppData\" or "\ProgramData\".
    Attackers often use such directories for staging purposes.
    This rule might also trigger on badly written software, where if an attacker controls an auto starting service, they might achieve persistence or privilege escalation.
    Note that while ProgramData is a user controlled folder, software might apply strict ACLs which makes them only accessible to admin users. Remove such folders via filters if you experience a lot of noise.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
date: 2022-05-02
modified: 2024-03-25
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
    - detection.threat-hunting
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - 'ControlSet'
            - '\Services\'
        TargetObject|endswith: '\ImagePath'
        Details|contains:
            - ':\ProgramData\'
            - '\AppData\Local\'
            - '\AppData\Roaming\'
    filter_optional_zoom:
        TargetObject|contains: '\Services\ZoomCptService'
        Details|contains: 'C:\Program Files\Common Files\Zoom\Support\CptService.exe'
    filter_optional_mbami:
        TargetObject|contains: '\Services\MBAMInstallerService'
        Details|contains|all:
            - 'C:\Users\'
            - 'AppData\Local\Temp\MBAMInstallerService.exe'
    filter_main_windefend:
        TargetObject|contains:
            - '\Services\WinDefend\'
            - '\Services\MpKs'
        Details|contains: 'C:\ProgramData\Microsoft\Windows Defender\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: selection

selection:
    TargetObject|contains|all:
        - 'ControlSet'
        - '\Services\'
    TargetObject|endswith: '\ImagePath'
    Details|contains:
        - ':\ProgramData\'
        - '\AppData\Local\'
        - '\AppData\Roaming\'

Stage 2: not filter_main_windefend

filter_main_windefend:
    TargetObject|contains:
        - '\Services\WinDefend\'
        - '\Services\MpKs'
    Details|contains: 'C:\ProgramData\Microsoft\Windows Defender\'

Stage 3: not filter_optional_*

filter_optional_zoom:
    TargetObject|contains: '\Services\ZoomCptService'
    Details|contains: 'C:\Program Files\Common Files\Zoom\Support\CptService.exe'
filter_optional_mbami:
    TargetObject|contains: '\Services\MBAMInstallerService'
    Details|contains|all:
        - 'C:\Users\'
        - 'AppData\Local\Temp\MBAMInstallerService.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
TargetObjectmatch\Services\MpKs
TargetObjectmatch\Services\WinDefend\
DetailsmatchC:\ProgramData\Microsoft\Windows Defender\
DetailsmatchAppData\Local\Temp\MBAMInstallerService.exe
DetailsmatchC:\Users\
TargetObjectmatch\Services\MBAMInstallerService
DetailsmatchC:\Program Files\Common Files\Zoom\Support\CptService.exe
TargetObjectmatch\Services\ZoomCptService

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailsmatch
  • :\ProgramData\ corpus 3 (sigma 3)
  • \AppData\Local\ corpus 2 (sigma 2)
  • \AppData\Roaming\ corpus 3 (sigma 3)
TargetObjectends_with
  • \ImagePath corpus 3 (sigma 3)
TargetObjectmatch
  • ControlSet corpus 3 (sigma 3)
  • \Services\ corpus 4 (sigma 4)