T1574.010 — Services File Permissions Weakness

Tactics: Stealth, Execution · Platforms: Windows

Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (1)

T1574.010 Hijack Execution Flow: Services File Permissions Weakness

title: "T1574.010 Hijack Execution Flow: Services File Permissions Weakness"
id: a4298ce3-f8eb-4f36-92c0-db0f674a43fa
description: 'Detection Strategy for Hijack Execution Flow through Services File Permissions Weakness — detects icacls/cacls granting Full Control (or /grant) over a System32 path to a broad principal (Everyone, Users, Authenticated Users). (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: MonitoredServices, HashBaseline, TimeWindow, PrivilegedAccounts.'
references:
  - https://attack.mitre.org/techniques/T1574/010
author: Shahrukh Khan
date: 2026-05-14
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.010

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\icacls.exe'
      - '\cacls.exe'
    CommandLine|contains: 'System32'

  grant_full_control:
    CommandLine|contains:
      - '/grant'
      - ':F'
      - ':(F)'

  broad_principal:
    CommandLine|contains:
      - 'Everyone'
      - ' Users:'
      - 'Authenticated Users'
      - 'BUILTIN\Users'

  condition: selection and grant_full_control and broad_principal

falsepositives:
  - Legitimate hardening/permissions-remediation scripts modifying the same ACLs for benign reasons — these typically restrict rather than broaden permissions.

level: high

Related sub-techniques

Explore