Detect Services File Permissions Weakness in CrowdStrike LogScale
Adversaries may replace service executable binaries by exploiting weak file or directory permissions on service binaries. Windows services run with specific account privileges (often SYSTEM, LocalService, or NetworkService). If the permissions on the service binary or its parent directory allow non-privileged users to write, an adversary can overwrite the binary with a malicious payload. When the service starts (on reboot or manually), the malicious binary executes at the service's privilege level. BlackEnergy malware used this technique to replace disabled driver service binaries and then re-enable the service for persistence. PowerSploit's Get-ModifiableServiceFile discovers exploitable service binaries.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.010 Services File Permissions Weakness
- Canonical reference
- https://attack.mitre.org/techniques/T1574/010/
LogScale Detection Query
#event_simpleName in ("ProcessRollup2", "SyntheticProcessRollup2")
| ImageFileName = /(?i)\\temp\\.*\.exe/
| ParentBaseFileName != /(?i)(msiexec|trustedinstaller|wusa|dpinst|svchost)/
| UserName != "SYSTEM"
| UserName != ""
| groupBy([aid, ComputerName, ImageFileName, ParentBaseFileName, UserName, CommandLine], function=[count(as=EventCount), min(timestamp, as=FirstSeen)])
| case {
ImageFileName = /(?i)\\temp\\/i AND ParentBaseFileName = /(?i)(setup|install|update)/ => RiskScore := "High";
ImageFileName = /(?i)\\temp\\/i => RiskScore := "Medium";
* => RiskScore := "Low";
}
| where RiskScore in ("High", "Medium")
| table([ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine, EventCount, RiskScore, FirstSeen])
| sort(RiskScore)CrowdStrike LogScale (Falcon) CQL detection for Services File Permissions Weakness. Detects modification of service binary files by non-SYSTEM, non-installer accounts. The query correlates file modification events on EXE/DLL files in service installation directories with the Services
Data Sources
Required Tables
False Positives & Tuning
- Legitimate enterprise installers that update extracted binaries during installation
- Software deployment tools (SCCM, Intune) staging and modifying installers in temp
- Self-patching applications that download and replace their own components
- Automated software update mechanisms that modify binaries before execution
Other platforms for T1574.010
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Check Service Binary Permissions for Exploitation
Expected signal: PowerShell process creation with WMI Win32_Service query and file ACL enumeration. Sysmon Event ID 19 may log the WMI query. Multiple file read operations to check ACLs on service binaries.
- Test 2Simulate Service Binary Replacement (Hash-Verified)
Expected signal: Service creation event (Security Event ID 7045). File modification event (Sysmon EventCode 11) for test_svc.exe after replacement. Hash change detectable via Sysmon event which includes SHA256.
- Test 3Verify Service Permission Using AccessChk
Expected signal: Process creation for accesschk.exe or icacls.exe with Program Files as target. These tools inspect file ACLs without modifying them. Security audit logs may capture the file access depending on auditing configuration.
Unlock Pro Content
Get the full detection package for T1574.010 including response playbook, investigation guide, and atomic red team tests.