windows enabled community medium v1.0.0

sc

Used by Windows to manage services Located at: C:\Windows\System32\sc.exe; C:\Windows\SysWOW64\sc.exe.

📋 Live Preview

sc

sc

Sandbox: execFile · Timeout: 30s

Capabilities

system.file.alternate-data-stream

Contract

Outputs

process.output

Command execution output

Side effects: filesystem_write

Workflow Edges

Produces

process.output

Resource Profile

Resource	Value
CPU	low
Memory	16 MB
Network	low
Disk I/O	low

Examples

Creates a new service and executes the file stored in the ADS. (Execute binary file hidden inside an alternate data stream)

sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto\ & sc start evilservice

Modifies an existing service and executes the file stored in the ADS. (Execute binary file hidden inside an alternate data stream)

sc config {ExistingServiceName} binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" & sc start {ExistingServiceName}

Detection

Type	Rule / Indicator
sigma	https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_susp_service_creation.yml
sigma	https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml
sigma	https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_sc_service_path_modification.yml
splunk	https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/sc_exe_manipulating_windows_services.yml
elastic	https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/lateral_movement_cmd_service.toml
ioc	Unexpected service creation
ioc	Unexpected service modification

Documentation

sc

sc is a Windows LOLBin. Used by Windows to manage services Located at: C:\Windows\System32\sc.exe; C:\Windows\SysWOW64\sc.exe.

sc