Threat Huntmediumtest

Service Binary in User Controlled Folder

Detects the setting of the "ImagePath" value of a service registry key to a path controlled by a non-administrator user such as "\AppData\" or "\ProgramData\". Attackers often use such directories for staging purposes. This rule might also trigger on badly written software, where if an attacker controls an auto starting service, they might achieve persistence or privilege escalation. Note that while ProgramData is a user controlled folder, software might apply strict ACLs which makes them only accessible to admin users. Remove such folders via filters if you experience a lot of noise.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)Created Mon May 02Updated Mon Mar 25277dc340-0540-42e7-8efb-5ff460045e07windows

Hunting Hypothesis

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains|all:
            - 'ControlSet'
            - '\Services\'
        TargetObject|endswith: '\ImagePath'
        Details|contains:
            - ':\ProgramData\'
            - '\AppData\Local\'
            - '\AppData\Roaming\'
    filter_optional_zoom:
        TargetObject|contains: '\Services\ZoomCptService'
        Details|contains: 'C:\Program Files\Common Files\Zoom\Support\CptService.exe'
    filter_optional_mbami:
        TargetObject|contains: '\Services\MBAMInstallerService'
        Details|contains|all:
            - 'C:\Users\'
            - 'AppData\Local\Temp\MBAMInstallerService.exe'
    filter_main_windefend:
        TargetObject|contains:
            - '\Services\WinDefend\'
            - '\Services\MpKs'
        Details|contains: 'C:\ProgramData\Microsoft\Windows Defender\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*