How do you detect weak service permission abuse?

Detect it from process creation and service events, not Event 7045 alone. Reconfiguring an existing service does not raise 7045, so alert on sc.exe config with binPath and on reg.exe or PowerShell edits to a service ImagePath. For new services, review Security 4697 and System 7045 for paths in Users, ProgramData or Temp and for cmd or PowerShell launch strings. Add file-integrity monitoring on SYSTEM service binaries, and audit exposure with accesschk and PowerUp so the weak ACLs are fixed before an attacker finds them.

Detecting Weak Service Permissions: sc config, binPath and ImagePath Changes

Services run with the privileges of their configured account, and many run as SYSTEM. When the service ACL or its registry key grants write access to ordinary users, they can change the binary path and restart the service (T1574.011). Creating a brand-new service is the louder alternative (T1543.003). The two need different detections because they leave different events.

Signals at a Glance

Signal	Where	ATT&CK
sc.exe config with binPath on an existing service	Sysmon 1, 4688	T1574.011
reg.exe or PowerShell editing a service ImagePath or FailureCommand	Sysmon 1, 13	T1574.011
New service installed with a path in a user-writable location	System 7045, Security 4697	T1543.003
Service stop and start from a non-administrative context	System 7036, EDR	T1543.003
Service binary replaced by a non-admin account	Sysmon 11, EDR file events	T1574.010

Reconfiguring an Existing Service

Event 7045 does not fire when an existing service is reconfigured, so do not rely on it for this technique. An sc.exe config call goes through the service control manager, which means Sysmon registry events usually show services.exe as the writer. The reliable signal is therefore the process creation for the command itself:

title: Service Binary Path Modified via sc.exe or Registry
logsource:
  product: windows
  category: process_creation
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - 'config'
      - 'binpath'
  selection_reg:
    Image|endswith: '\reg.exe'
    CommandLine|contains|all:
      - 'CurrentControlSet\Services'
      - 'ImagePath'
  condition: 1 of selection_*
level: high
# tune/validate: software installers call sc config; allowlist by parent and signer.

New Services and Writable Binaries

When the attacker cannot reconfigure but can replace the service executable, or has the rights to create a service, the events change. Review 4697 and 7045 for paths and command shapes that no vendor installer would use:

// Microsoft Sentinel (KQL) - new services pointing at risky locations
SecurityEvent
| where EventID == 4697
| where ServiceFileName has_any ("Users","ProgramData","Temp","AppData","cmd /c","powershell","%COMSPEC%")
| project TimeGenerated, Computer, SubjectUserName, ServiceName, ServiceFileName, ServiceAccount
// tune/validate: remote-management tools install services legitimately (for example PSExec-style agents).

Audit the exposure with Sysinternals accesschk against the Users and Authenticated Users groups for write and change-config rights, and with PowerUp’s modifiable-service checks.
Add file-integrity monitoring on the binaries behind SYSTEM services. A write by a non-admin account is the earliest signal of T1574.010.
Alert on a service starting from a path that differs from the last known-good value for that service name.

Vetted sources

Use the SigmaHQ sc.exe and service-install rules, Elastic’s prebuilt rules for service path modification, Sysinternals accesschk and PowerUp for exposure audits, and Atomic Red Team T1543.003 for validation. Baseline your own environment — endpoint agents and management tools legitimately reconfigure services.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Reconfiguring an Existing Service

New Services and Writable Binaries

Build Detections That Fire

Privilege Escalation Detection

Detection Hub

Unquoted Service Path Detection

Writable PATH Privilege Escalation