T1574.011 — Services Registry Permissions Weakness

Tactics: Stealth, Execution · Platforms: Windows

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (1)

T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness

title: "T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness"
id: 88e4ff0b-100a-4e6e-bcdb-34f821bfe945
description: 'Detects modification of service configuration registry values (ImagePath, ObjectName, FailureCommand) under HKLM\SYSTEM\CurrentControlSet\Services, which is how a services registry permissions weakness is actually exploited; the previous version used a nonexistent EventID/channel pairing (EventID ''1'' under the Windows System log service) that does not correspond to any real telemetry source. Tune using: MonitoredServiceKeys, BaselineServiceConfig, TimeWindow, PrivilegedAccounts.'
references:
  - https://attack.mitre.org/techniques/T1574/011
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.011

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    TargetObject|contains: '\System\CurrentControlSet\Services\'
    TargetObject|endswith:
      - '\ImagePath'
      - '\ObjectName'
      - '\FailureCommand'

  filter_installer:
    Image:
      - 'C:\Windows\System32\msiexec.exe'
      - 'C:\Windows\servicing\TrustedInstaller.exe'

  condition: selection and not filter_installer

falsepositives:
  - Legitimate software installers and Windows Servicing/MSI operations modifying their own service keys are excluded via filter_installer; tune further with change-management allowlists if noise remains.

level: medium

Related sub-techniques

Explore