Sigma rule: Service Binary in User Controlled Folder

Rule

Title

Service Binary in User Controlled Folder

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)

Date

2022-05-02

Modified

2024-03-25

File

rules-threat-hunting/windows/registry/registry_set/registry_set_service_image_path_user_controlled_folder.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the setting of the "ImagePath" value of a service registry key to a path controlled by a non-administrator user such as "\AppData\" or "\ProgramData\".
Attackers often use such directories for staging purposes.
This rule might also trigger on badly written software, where if an attacker controls an auto starting service, they might achieve persistence or privilege escalation.
Note that while ProgramData is a user controlled folder, software might apply strict ACLs which makes them only accessible to admin users. Remove such folders via filters if you experience a lot of noise.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains|all:
        - 'ControlSet'
        - '\Services\'
    TargetObject|endswith: '\ImagePath'
    Details|contains:
        - ':\ProgramData\'
        - '\AppData\Local\'
        - '\AppData\Roaming\'
filter_optional_zoom:
    TargetObject|contains: '\Services\ZoomCptService'
    Details|contains: 'C:\Program Files\Common Files\Zoom\Support\CptService.exe'
filter_optional_mbami:
    TargetObject|contains: '\Services\MBAMInstallerService'
    Details|contains|all:
        - 'C:\Users\'
        - 'AppData\Local\Temp\MBAMInstallerService.exe'
filter_main_windefend:
    TargetObject|contains:
        - '\Services\WinDefend\'
        - '\Services\MpKs'
    Details|contains: 'C:\ProgramData\Microsoft\Windows Defender\'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.defense-impairment
• attack.t1112
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1112

Related rules

• c625c4c2-515d-407f-8bb6-456f65955669 (obsolete)

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/registry/registry_set/registry_set_service_image_path_user_controlled_folder.yml