LoFP / excessive execution of sc.exe is quite suspicious since it can modify or execute app in high privilege permission.

Techniques

• T1569
• T1569.002

Sample rules

Excessive Usage Of SC Service Utility

• source: splunk
• technicques:
  • T1569
  • T1569.002

Description

The following analytic detects excessive usage of the sc.exe service utility on a host machine. It leverages Sysmon EventCode 1 logs to identify instances where sc.exe is executed more frequently than normal within a 15-minute window. This behavior is significant as it is commonly associated with ransomware, cryptocurrency miners, and other malware attempting to create, modify, delete, or disable services, potentially related to security applications or for privilege escalation. If confirmed malicious, this activity could allow attackers to manipulate critical services, leading to system compromise or disruption of security defenses.

Detection logic

`sysmon` EventCode = 1 process_name = "sc.exe" 
|  bucket _time span=15m 
| stats values(process) as process count as numScExe by dest, _time 
|  eventstats avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by dest 
|  eval upperThreshold=(avgScExe + stdScExe *3) 
|  eval isOutlier=if(avgScExe > 5 and avgScExe >= upperThreshold, 1, 0) 
|  search isOutlier=1 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `excessive_usage_of_sc_service_utility_filter`