Service Binary in User Controlled Folder

title: Service Binary in User Controlled Folder
id: 277dc340-0540-42e7-8efb-5ff460045e07
related:
    - id: c625c4c2-515d-407f-8bb6-456f65955669
      type: obsolete
status: test
description: |
    Detects the setting of the "ImagePath" value of a service registry key to a path controlled by a non-administrator user such as "\AppData\" or "\ProgramData\".
    Attackers often use such directories for staging purposes.
    This rule might also trigger on badly written software, where if an attacker controls an auto starting service, they might achieve persistence or privilege escalation.
    Note that while ProgramData is a user controlled folder, software might apply strict ACLs which makes them only accessible to admin users. Remove such folders via filters if you experience a lot of noise.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
date: 2022-05-02
modified: 2024-03-25
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
    - detection.threat-hunting
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - 'ControlSet'
            - '\Services\'
        TargetObject|endswith: '\ImagePath'
        Details|contains:
            - ':\ProgramData\'
            - '\AppData\Local\'
            - '\AppData\Roaming\'
    filter_optional_zoom:
        TargetObject|contains: '\Services\ZoomCptService'
        Details|contains: 'C:\Program Files\Common Files\Zoom\Support\CptService.exe'
    filter_optional_mbami:
        TargetObject|contains: '\Services\MBAMInstallerService'
        Details|contains|all:
            - 'C:\Users\'
            - 'AppData\Local\Temp\MBAMInstallerService.exe'
    filter_main_windefend:
        TargetObject|contains:
            - '\Services\WinDefend\'
            - '\Services\MpKs'
        Details|contains: 'C:\ProgramData\Microsoft\Windows Defender\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium