{"id":"e83e8899-c9b2-483b-b355-5decc942b959","title":"Interesting Service Enumeration Via Sc.EXE","description":"Detects the enumeration and query of interesting and in some cases sensitive services on the system via \"sc.exe\".\nAttackers often try to enumerate the services currently running on a system in order to find different attack vectors.\n","author":"Swachchhanda Shrawan Poudel","status":"test","level":"low","date":"2024-02-12","modified":"","tags":["attack.t1003","attack.credential-access"],"technique_ids":["T1003"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/","https://pentestlab.blog/tag/svchost/"],"source_path":"rules/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml","source_sha256":"08d2d595d16d79b613e8d917950c381bad869d45e36119231e120f0659513ccb","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Interesting Service Enumeration Via Sc.EXE\nid: e83e8899-c9b2-483b-b355-5decc942b959\nstatus: test\ndescription: |\n    Detects the enumeration and query of interesting and in some cases sensitive services on the system via \"sc.exe\".\n    Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.\nreferences:\n    - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/\n    - https://pentestlab.blog/tag/svchost/\nauthor: Swachchhanda Shrawan Poudel\ndate: 2024-02-12\ntags:\n    - attack.t1003\n    - attack.credential-access\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_img:\n        - Image|endswith: '\\sc.exe'\n        - OriginalFileName: 'sc.exe'\n    selection_cli:\n        CommandLine|contains: 'query'\n    selection_cmd:\n        # Note: add more interesting services\n        CommandLine|contains: 'termservice'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\n# Note: can be upgraded to medium after an initial baseline\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","page":"techniques/enterprise/T1003/"}],"data_path":"data/detection-rules/e83e8899-c9b2-483b-b355-5decc942b959.json","kind":"sigma"}