Detect Services File Permissions Weakness in Splunk
Adversaries may replace service executable binaries by exploiting weak file or directory permissions on service binaries. Windows services run with specific account privileges (often SYSTEM, LocalService, or NetworkService). If the permissions on the service binary or its parent directory allow non-privileged users to write, an adversary can overwrite the binary with a malicious payload. When the service starts (on reboot or manually), the malicious binary executes at the service's privilege level. BlackEnergy malware used this technique to replace disabled driver service binaries and then re-enable the service for persistence. PowerSploit's Get-ModifiableServiceFile discovers exploitable service binaries.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.010 Services File Permissions Weakness
- Canonical reference
- https://attack.mitre.org/techniques/T1574/010/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "(\.exe|\.dll)$")
| where match(lower(TargetFilename), "(program files|windows)")
| where User!="NT AUTHORITY\\SYSTEM" AND User!="" AND NOT match(User, "SYSTEM|TrustedInstaller")
| where NOT match(lower(Image), "(msiexec|wusa|trustedinstaller|windowsupdate|svchost)")
| eval Severity="HIGH"
| table _time, host, User, TargetFilename, Image, ProcessGuid, Severity
| sort - _timeDetects file creation/modification of EXE/DLL files in Program Files or Windows directories by non-SYSTEM, non-TrustedInstaller, non-updater accounts. This directly identifies service binary replacement — the most critical signal for services file permissions weakness exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Software update processes that run in user context (common for some applications)
- IT deployment tools pushing updates to service binaries
- Developer accounts with explicit write permissions to Program Files
- Game launchers and similar applications that self-update service components
Other platforms for T1574.010
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Check Service Binary Permissions for Exploitation
Expected signal: PowerShell process creation with WMI Win32_Service query and file ACL enumeration. Sysmon Event ID 19 may log the WMI query. Multiple file read operations to check ACLs on service binaries.
- Test 2Simulate Service Binary Replacement (Hash-Verified)
Expected signal: Service creation event (Security Event ID 7045). File modification event (Sysmon EventCode 11) for test_svc.exe after replacement. Hash change detectable via Sysmon event which includes SHA256.
- Test 3Verify Service Permission Using AccessChk
Expected signal: Process creation for accesschk.exe or icacls.exe with Program Files as target. These tools inspect file ACLs without modifying them. Security audit logs may capture the file access depending on auditing configuration.
Unlock Pro Content
Get the full detection package for T1574.010 including response playbook, investigation guide, and atomic red team tests.