| splunk |
Windows Service Creation Using Registry Entry |
production |
2026-10-02 |
| elastic |
Potential Privilege Escalation via Service ImagePath Modification |
production |
2026-09-18 |
| elastic |
Persistence via Update Orchestrator Service Hijack |
production |
2026-09-18 |
| elastic |
Unusual Persistence via Services Registry |
production |
2026-09-18 |
| elastic |
Unsigned DLL Loaded by Svchost |
production |
2026-09-18 |
| splunk |
Reg exe Manipulating Windows Services Registry Keys |
production |
2026-05-13 |
| sigma |
Potential Privilege Escalation via Service Permissions Weakness |
test |
2024-12-01 |
| sigma |
Possible Privilege Escalation via Weak Service Permissions |
test |
2024-12-01 |
| sigma |
Changing Existing Service ImagePath Value Via Reg.EXE |
test |
2024-03-13 |
| sigma |
Service Registry Key Read Access Request |
test |
2023-09-28 |
| sigma |
Service Security Descriptor Tampering Via Sc.EXE |
test |
2023-02-28 |
| sigma |
Potential Persistence Attempt Via Existing Service Tampering |
test |
2023-02-04 |
| sigma |
Suspicious Service DACL Modification Via Set-Service Cmdlet - PS |
test |
2022-10-24 |
| sigma |
Abuse of Service Permissions to Hide Services Via Set-Service |
test |
2022-10-17 |
| sigma |
Abuse of Service Permissions to Hide Services Via Set-Service - PS |
test |
2022-10-17 |
| sigma |
Service DACL Abuse To Hide Services Via Sc.EXE |
test |
2022-08-08 |
| sigma |
Service Registry Permissions Weakness Check |
test |
2021-12-30 |