CQURE HACKS #66 Hiding and Modifying Windows Services with Service Control

Source: CQURE Academy

Author: Kate Chrzan

URL: https://cqureacademy.com/blog/66-hiding-and-modifying-windows-services/

CQURE HACKS #66 Hiding and Modifying Windows Services with Service Control

ONE SENTENCE SUMMARY:

The guide explains using SDDL to hide Windows services for persistence and detection methods via different tools.

MAIN POINTS:

1. SDDL manipulation can hide Windows services for post-incident investigations.
2. Use “sc sdshow” to display a service’s SDDL string.
3. Modify a service’s SDDL with “sc sdset” to change visibility.
4. The DACL section of SDDL controls permissions and visibility.
5. Different APIs respond differently based on permission settings.
6. “Get-Service” may not show hidden services due to SDDL settings.
7. Autoruns detects services by reading the registry, bypassing SDDL restrictions.
8. Unhide services by resetting the SDDL to a default descriptor.
9. Advanced techniques include DKOM for deeper process hiding.
10. SDDL is applicable to many Windows objects beyond services.

TAKEAWAYS:

1. SDDL manipulation is crucial for understanding service persistence.
2. Autoruns can detect hidden services through the registry.
3. Resetting SDDL settings reveals hidden services.
4. Different tools respond to hidden services based on API interaction.
5. Understanding SDDL enhances cybersecurity incident investigation skills.