Service Registry Key Read Access Request

Status: test
Severity: low
Log source: product windows, service security
Author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
Source: github.com/SigmaHQ/sigma

Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

Known false positives

Likely from legitimate applications reading their key. Requires heavy tuning

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1574.011` Hijack Execution Flow: Services Registry Permissions Weakness
Stealth	`T1574.011` Hijack Execution Flow: Services Registry Permissions Weakness

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4663: An attempt was made to access an object.

Rule body

title: Service Registry Key Read Access Request
id: 11d00fff-5dc3-428c-8184-801f292faec0
status: test
description: |
    Detects "read access" requests on the services registry key.
    Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
    Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
references:
    - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
date: 2023-09-28
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.011
logsource:
    product: windows
    service: security
    definition: 'Requirements: SACLs must be enabled for "READ_CONTROL" on the registry keys used in this rule'
detection:
    selection:
        EventID: 4663
        ObjectName|contains|all:
            - '\SYSTEM\'
            - 'ControlSet\Services\'
        AccessList|contains: '%%1538' # READ_CONTROL
    condition: selection
falsepositives:
    - Likely from legitimate applications reading their key. Requires heavy tuning
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 4663
    ObjectName|contains|all:
        - '\SYSTEM\'
        - 'ControlSet\Services\'
    AccessList|contains: '%%1538'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AccessList`	match	`%%1538`	`field:"AccessList" kind:match value:"%%1538"`
`ObjectName`	match	`ControlSet\Services\` `\SYSTEM\`	`field:"ObjectName" kind:match`