title: Possible Privilege Escalation via Service Permissions Weakness
id: 0f9c21f1-6a73-4b0e-9809-cb562cb8d981
description: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
    - https://pentestlab.blog/2017/03/31/insecure-registry-permissions/
tags:
    - attack.privilege_escalation
    - attack.t1574.011
status: experimental
author: Teymur Kheirkhabarov
date: 2019/10/26
modified: 2021/09/15
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        IntegrityLevel: 'Medium'
        CommandLine|contains|all:
            - ControlSet
            - services
        CommandLine|contains:
            - \ImagePath
            - \FailureCommand
            - \ServiceDll
    condition: selection
falsepositives:
    - Unknown
level: high
enrichment:
    - EN_0001_cache_sysmon_event_id_1_info                      # http://bit.ly/314zc6x
    - EN_0003_enrich_other_sysmon_events_with_event_id_1_data   # http://bit.ly/2ojW7fw
