SC.EXE Query Execution

A Sigma rule for process creation on Windows, from SigmaHQ’s threat hunting rules, by frack113.

low 1 ATT&CK technique 1 program it names 9 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  filter_optional_keybase:
    CommandLine: 'sc query dokan1'
  selection_cli:
    CommandLine|contains: ' query'
  selection_img:
    Image|endswith: '\sc.exe'
    OriginalFileName: 'sc.exe'
  condition: all of selection_* and not 1 of filter_optional_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by frack113, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Show the status of a service (no service name will list all services) on the page for sc.exe

sc query service_nameIdentify

To display information for active services only, type either of the following commands on the page for sc query

sc.exe query
sc.exe query type= service

Identify

To display information for active services, and to specify a buffer size of 2,000 bytes, type on the page for sc query

sc.exe query type= all bufsize= 2000Identify

To display information for the wuauserv service, type on the page for sc query

sc.exe query wuauservIdentify

To display information for all services (active and inactive), type on the page for sc query

sc.exe query state= allIdentify

To display information for all services (active and inactive), beginning at line 56, type on the page for sc query

sc.exe query state= all ri= 56Identify

To display information for interactive services, type on the page for sc query

sc.exe query type= service type= interactIdentify

To display information for drivers only, type on the page for sc query

sc.exe query type= driverIdentify

To display information for drivers in the Network Driver Interface Specification (NDIS) group, type on the page for sc query

sc.exe query type= driver group= NDISIdentify

Programs and files it names

their pages here

sc.exe

ATT&CK

the techniques it is tagged with

T1007System Service Discovery

SC.EXE Query Execution

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1007 System Service Discovery