Detection rules › Sigma
Service Registry Key Read Access Request
Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
MITRE ATT&CK coverage
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4663 | An attempt was made to access an object. |
Rule body yaml
title: Service Registry Key Read Access Request
id: 11d00fff-5dc3-428c-8184-801f292faec0
status: test
description: |
Detects "read access" requests on the services registry key.
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
references:
- https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
date: 2023-09-28
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.011
logsource:
product: windows
service: security
definition: 'Requirements: SACLs must be enabled for "READ_CONTROL" on the registry keys used in this rule'
detection:
selection:
EventID: 4663
ObjectName|contains|all:
- '\SYSTEM\'
- 'ControlSet\Services\'
AccessList|contains: '%%1538' # READ_CONTROL
condition: selection
falsepositives:
- Likely from legitimate applications reading their key. Requires heavy tuning
level: low
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 4663
ObjectName|contains|all:
- '\SYSTEM\'
- 'ControlSet\Services\'
AccessList|contains: '%%1538'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
AccessList | match |
|
ObjectName | match |
|