Detect Services File Permissions Weakness in Google Chronicle
Adversaries may replace service executable binaries by exploiting weak file or directory permissions on service binaries. Windows services run with specific account privileges (often SYSTEM, LocalService, or NetworkService). If the permissions on the service binary or its parent directory allow non-privileged users to write, an adversary can overwrite the binary with a malicious payload. When the service starts (on reboot or manually), the malicious binary executes at the service's privilege level. BlackEnergy malware used this technique to replace disabled driver service binaries and then re-enable the service for persistence. PowerSploit's Get-ModifiableServiceFile discovers exploitable service binaries.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.010 Services File Permissions Weakness
- Canonical reference
- https://attack.mitre.org/techniques/T1574/010/
YARA-L Detection Query
rule T1574_010_hijack_execution {
meta:
author = "Detection Engineering"
description = "Detects execution flow hijacking via installer or DLL path manipulation"
severity = "high"
confidence = "medium"
mitre_attack = "T1574.010"
reference = "https://attack.mitre.org/techniques/T1574/010/"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
(
re.regex($e.target.process.file.full_path, `(?i)\\temp\\.*\.exe`) or
re.regex($e.target.process.file.full_path, `(?i)\\appdata\\.*\.exe`)
)
not re.regex($e.principal.process.file.full_path, `(?i)(msiexec|trustedinstaller|wusa|dpinst)`)
not $e.principal.user.user_display_name = "SYSTEM"
condition:
$e
}Google Chronicle YARA-L 2.0 detection for Services File Permissions Weakness. Detects modification of service binary files by non-SYSTEM, non-installer accounts. The query correlates file modification events on EXE/DLL files in service installation directories with the Services
Data Sources
Required Tables
False Positives & Tuning
- Legitimate multi-stage installer processes that modify binaries during installation phases
- Enterprise software deployment tools staging installer components in temp directories
- Self-updating applications that download and replace their own binaries
- Archive utilities that extract executables to temp before running them
Other platforms for T1574.010
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Check Service Binary Permissions for Exploitation
Expected signal: PowerShell process creation with WMI Win32_Service query and file ACL enumeration. Sysmon Event ID 19 may log the WMI query. Multiple file read operations to check ACLs on service binaries.
- Test 2Simulate Service Binary Replacement (Hash-Verified)
Expected signal: Service creation event (Security Event ID 7045). File modification event (Sysmon EventCode 11) for test_svc.exe after replacement. Hash change detectable via Sysmon event which includes SHA256.
- Test 3Verify Service Permission Using AccessChk
Expected signal: Process creation for accesschk.exe or icacls.exe with Program Files as target. These tools inspect file ACLs without modifying them. Security audit logs may capture the file access depending on auditing configuration.
Unlock Pro Content
Get the full detection package for T1574.010 including response playbook, investigation guide, and atomic red team tests.