T1543.003PersistenceAdvancedDefense plan →

Windows Service and SCM Abuse: Persistence, Privilege Escalation, and Lateral Movement

HARDEC · Savunma Güvenliği Ekibi·Published: June 13, 2026·Updated: July 15, 2026·12 min read

A comprehensive map of the Windows Service Control Manager (SCM) attack surface: new service creation (T1543.003), ServiceDll hijack, unquoted path / weak binary and registry ACL exploitation (T1574.009-011), PsExec-style transient service for lateral movement (T1569.002). EID 7045/4697, Sysmon EID 13 detection, and Sigma correlations for SOC and red/purple teams.

Active exploitation warning

The following vulnerabilities referenced in this content are under active exploitation in the CISA KEV catalog:

Source: CISA KEV ·

Exploit

Prevention

Detection

Defense profile:5 detection rules 10 mitigations 3 response playbooks

Swipe or use the arrows to move between sections

Section 1 / 3

Zafiyet (Vulnerability)

Tehdit bağlamı, zafiyet ve istismar senaryosu

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 2 / 3

Prevention & Hardening

Savunma teknolojileri, policy ve sertleştirme

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 3 / 3

Detection

Davranış, loglama ve detection kuralları

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Information note

Detection and hardening: For persistence established through the Windows Service Control Manager, System log Event ID 7045 and Security log Event ID 4697 are the primary indicators. The unquoted service path vulnerability affects services installed in directories containing spaces; therefore, all service paths must be verified to be enclosed in quotation marks. Tools that use SCM for lateral movement open an RPC tunnel; monitoring this traffic at the network layer provides an additional visibility layer that complements endpoint detection (MITRE ATT&CK T1543.003).

Detection rules

Directly copyable rules (Sigma/KQL/…) that detect this technique. Each rule specifies its required telemetry, maturity, and source.

CobaltStrike Service Installations - System

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

critical

sigmaTest

Show ruleHide rule

title: CobaltStrike Service Installations - System
id: 5a105d34-05fc-401e-8553-272b45c1522d
status: test
description: Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
references:
    - https://www.sans.org/webcasts/119395
    - https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
    - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
author: Florian Roth (Nextron Systems), Wojciech Lesicki
date: 2021-05-26
modified: 2022-11-27
tags:
    - attack.persistence
    - attack.execution
    - attack.privilege-escalation
    - attack.lateral-movement
    - attack.t1021.002
    - attack.t1543.003
    - attack.t1569.002
logsource:
    product: windows
    service: system
detection:
    selection_id:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection1:
        ImagePath|contains|all:
            - 'ADMIN$'
            - '.exe'
    selection2:
        ImagePath|contains|all:
            - '%COMSPEC%'
            - 'start'
            - 'powershell'
    selection3:
        ImagePath|contains: 'powershell -nop -w hidden -encodedcommand'
    selection4:
        ImagePath|base64offset|contains: "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:"
    condition: selection_id and (selection1 or selection2 or selection3 or selection4)
falsepositives:
    - Unknown
level: critical

Not validated

Telemetry required to run: windows; systemwindows / systemwindows

False positive: Unknown

Source: SIGMA · Detection Rule License (DRL) 1.1 · original rule

Mitigations

Prevention and hardening measures that mitigate or block this technique.

Audit

Prevention

Advanced audit policy + command-line auditing + Sysmon + directory access auditing: the telemetry that detection requires.

Information note

Informational note: Default Windows audit policies are insufficient; critical events such as failed logons, sensitive privilege use, and object access require additional configuration. Process creation command-line records and network connection logs must be collected with Sysmon. On Linux, auditd default settings are extremely minimal and must be customized for security use cases. Since collection is impossible without log generation, audit policy configuration must be completed before SIEM integration.

Behavior Prevention on Endpoint

Prevention

Block common attack behaviors using Defender ASR rules and Office macro restrictions.

Information note

Informational note: Behavioral prevention at the endpoint encompasses EDR and XDR capabilities beyond signature-based AV. Microsoft Defender ASR rules stop Office applications from spawning child processes, executable content from email, and PowerShell injection. ASR rules should first be deployed in audit mode to assess the false positive rate before switching to block mode.

Response playbooks

NIST/SANS phase-based response workflows to follow when this technique is detected.

Techniques in the Persistence tactic

T1053.005PersistenceAdvanced

Windows Task Scheduler (schtasks.exe / Schedule.Service COM) is widely used by attackers for both persistence and remote execution (lateral movement). This article covers schtasks syntax, XML task structure, TaskCache registry, EID 4698/4699/4700/4701/4702 + TaskScheduler/Operational 106/140/141/200/201 telemetry, Sigma rules, and hardening controls.

June 13, 202610 min read

Exploit

Prevention

Detection

References

MITRE ATT&CK — T1543.003: Windows Service and SCM Abuse: Persistence, Privilege Escalation, and Lateral Movement ↗

This article is based on the MITRE ATT&CK framework; the detection, defense, and response content was prepared independently.

title: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE id: 6c8fbee5-dee8-49bc-851d-c3142d02aa47 related: - id: a537cfc3-4297-4789-92b5-345bfd845ad0 # Generic SD tampering type: similar status: test description: Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs. references: - https://twitter.com/0gtweet/status/1628720819537936386 - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-28 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_sc: - Image|endswith: '\sc.exe' - OriginalFileName: 'sc.exe' selection_sdset: CommandLine|contains|all: - 'sdset' - 'A;' # Allow Access selection_trustee: CommandLine|contains: - ';IU' # Interactively logged-on user - ';SU' # Service logon user - ';BA' # Built-in administrators - ';SY' # Local system - ';WD' # Everyone filter_optional_hexnode: ParentImage: 'C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe' condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: high

title: Suspicious Windows Service Installation with Anomalous ImagePath id: b4e7a2c9-6f1d-4b8a-c3e5-9d0f2a1b8e37 status: experimental description: | Detects new Windows service installations (System EID 7045) where the ImagePath field contains indicators of command-line abuse: PowerShell download cradles, LOLBins, temp/admin-share paths, or command chaining. Attackers install malicious services to achieve SYSTEM-level persistence. Covers techniques used by ransomware (WannaCry), RATs (Emotet, TrickBot), and lateral movement toolkits. AI-generated / unvalidated. references: - https://attack.mitre.org/techniques/T1543/003/ - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_susp.yml - https://www.elastic.co/guide/en/security/current/windows-service-via-unusual-client.html author: CyberSecLab (AI) date: 2026-06-13 tags: - attack.t1543.003 - attack.persistence - attack.privilege_escalation logsource: product: windows service: system detection: selection_eid: EventID: 7045 Provider_Name: 'Service Control Manager' selection_susp_path: ImagePath|contains: - '\Temp\' - '\ProgramData\' - '\Users\Public\' - '\AppData\' - '\ADMIN$\' - '\Perflogs\' - '\Windows\Temp\' selection_susp_cmd: ImagePath|contains: - ' -nop ' - ' -noprofile ' - ' -sta ' - ' -w hidden ' - ' -enc ' - ' -EncodedCommand ' - '.downloadfile(' - '.downloadstring(' - 'IEX(' - 'Invoke-Expression' - 'bitsadmin' - 'certutil' - '&&' - 'cmd.exe /c' - 'cmd /c' filter_main_legit_path: ImagePath|startswith: - 'C:\Windows\System32\' - 'C:\Windows\SysWOW64\' - 'C:\Program Files\' - 'C:\Program Files (x86)\' ServiceType|contains: 'kernel' condition: selection_eid and (selection_susp_path or selection_susp_cmd) and not 1 of filter_main_* falsepositives: - Yönetim araçları (SCCM, Ansible, Puppet) geçici dizinlere dağıtım yapabilir - Güvenlik ürünleri yükleme sırasında geçici yollar kullanabilir - Test ortamlarında yazılım geliştirme süreçleri level: high

title: New Windows Service Created via sc.exe id: 7d3a1f8e-2c6b-4d9f-a7c2-5e8b0d3f1a92 status: experimental description: | Detects the use of sc.exe to create or configure a new Windows service (create or binPath subcommands). While sc.exe has legitimate uses, its use from unusual parent processes or with suspicious binPath values indicates attacker activity. Covers lateral movement via PsExec-style service creation and persistence establishment by malware droppers. AI-generated / unvalidated. references: - https://attack.mitre.org/techniques/T1543/003/ - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_create_service.yml - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_service_path_modification.yml author: CyberSecLab (AI) date: 2026-06-13 tags: - attack.t1543.003 - attack.persistence - attack.privilege_escalation - attack.lateral_movement logsource: product: windows category: process_creation detection: selection_image: Image|endswith: '\sc.exe' OriginalFileName: 'sc.exe' selection_create: CommandLine|contains: - ' create ' - ' config ' selection_binpath: CommandLine|contains: - 'binPath=' - 'binpath=' selection_susp_context: CommandLine|contains: - 'cmd.exe' - 'powershell' - 'mshta' - 'wscript' - 'cscript' - 'rundll32' - 'regsvr32' - '\Temp\' - '\AppData\' - '\ProgramData\' - '\Public\' filter_main_legit_parent: ParentImage|endswith: - '\services.exe' - '\msiexec.exe' filter_optional_enterprise: ParentImage|contains: - '\Dropbox\' - '\AnyDesk\' - '\TeamViewer\' condition: all of selection_image and selection_create and selection_binpath and (selection_susp_context or not 1 of filter_main_*) falsepositives: - SCCM, Intune veya Puppet gibi araçlarla servis dağıtımı yapan IT sistemleri - Uzaktan erişim yazılımları (AnyDesk, TeamViewer) kendi servislerini oluşturabilir - Sistem yöneticilerinin elle servis yapılandırma işlemleri level: medium

Windows Service and SCM Abuse: Persistence, Privilege Escalation, and Lateral Movement

Active exploitation warning

Zafiyet (Vulnerability)

This section is not open yet

Prevention & Hardening

This section is not open yet

Detection

This section is not open yet

Detection rules

CobaltStrike Service Installations - System

Mitigations

Audit

Behavior Prevention on Endpoint

Response playbooks

Techniques in the Persistence tactic

References

Moriya Rootkit - System

Allow Service Access Using Security Descriptor Tampering Via Sc.EXE

Suspicious Windows Service Installation with Suspicious ImagePath (EID 7045)

New Windows Service Creation via sc.exe

Code Signing

Limit Software Installation

Network Segmentation

Operating System Configuration

Privileged Account Management

Restrict File and Directory Permissions

Software Configuration

User Account Management

WMI Event Subscription Persistence: Hidden Backdoors with EventFilter / EventConsumer / __FilterToConsumerBinding

Linux Attack Detection and DFIR: Persistence, Privilege Escalation, and Log Analysis

Lateral Movement Response: PsExec / Transient Service

Hypothesis-Driven Threat Hunting and Hunt-to-Detection Loop

Windows Service / SCM Persistence and Privilege Escalation Response

Windows Service and SCM Abuse: Persistence, Privilege Escalation, and Lateral Movement

Active exploitation warning

This section is not open yet

This section is not open yet

This section is not open yet

Detection rules

CobaltStrike Service Installations - System

Mitigations

Audit

Behavior Prevention on Endpoint

Response playbooks

Techniques in the Persistence tactic

References

Moriya Rootkit - System

Allow Service Access Using Security Descriptor Tampering Via Sc.EXE

Suspicious Windows Service Installation with Suspicious ImagePath (EID 7045)

New Windows Service Creation via sc.exe

Code Signing

Limit Software Installation

Network Segmentation

Operating System Configuration

Privileged Account Management

Restrict File and Directory Permissions

Software Configuration

User Account Management

WMI Event Subscription Persistence: Hidden Backdoors with __EventFilter / __EventConsumer / __FilterToConsumerBinding

Linux Attack Detection and DFIR: Persistence, Privilege Escalation, and Log Analysis

Lateral Movement Response: PsExec / Transient Service

Hypothesis-Driven Threat Hunting and Hunt-to-Detection Loop

Windows Service / SCM Persistence and Privilege Escalation Response

WMI Event Subscription Persistence: Hidden Backdoors with EventFilter / EventConsumer / __FilterToConsumerBinding