Identifier / Programs / Windows

sc.exe

Communicate with the Service Control Manager and services. tldr-pages

LOLBAS ADS 19 Sigma rules name it 7 ATT&CK techniques 2 documented commands 12 known copies with hashes

How sc.exe is abused

documented by LOLBAS

ADS T1564.004 Hide Artifacts: NTFS File Attributes

create evilservice works

-c

ADS T1564.004 Hide Artifacts: NTFS File Attributes

config works

-c

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for sc.exe.

2 documented commands

from LOLBAS, each read by the identifier

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Creates a new service and executes the file stored in the ADS.

sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto\ & sc start evilservice

Identify

Trips no Sigma process-creation rule.

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Modifies an existing service and executes the file stored in the ADS.

sc config {ExistingServiceName} binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" & sc start {ExistingServiceName}

Identify

Trips 1 Sigma rule: mediumPotential Persistence Attempt Via Existing Service Tampering by Sreeman

1 of the 2 commands the identifier reads trips a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for sc.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for sc.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highPossible Privilege Escalation via Weak Service PermissionsTeymur Kheirkhabarov

highAllow Service Access Using Security Descriptor Tampering Via Sc.EXENasreddine Bencherchali (Nextron Systems)

highDeny Service Access Using Security Descriptor Tampering Via Sc.EXEJonhnathan Ribeiro, oscd.community

highService DACL Abuse To Hide Services Via Sc.EXEAndreas Hunkeler (@Karneades)

mediumService StartupType Change Via Sc.EXENasreddine Bencherchali (Nextron Systems)

mediumNew Kernel Driver Via SC.EXENasreddine Bencherchali (Nextron Systems)

mediumService Security Descriptor Tampering Via Sc.EXENasreddine Bencherchali (Nextron Systems)

lowSC.EXE Query Executionfrack113

lowNew Service Creation Using Sc.EXETimur Zinniatullin, Daniil Yugoslavskiy, oscd.community

lowInteresting Service Enumeration Via Sc.EXESwachchhanda Shrawan Poudel

lowStop Windows Service Via Sc.EXEJakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)

highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

highDisable Windows Defender AV Security Monitoringok @securonix invrep-de, oscd.community, frack113

highSuspicious Service Path ModificationVictor Sergeev, oscd.community, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)

highSuspicious New Service CreationNasreddine Bencherchali (Nextron Systems)

highSuspicious Windows Service TamperingNasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

mediumRecon Information for Export with Command Promptfrack113

T1003OS Credential Dumping

T1007System Service Discovery

T1489Service Stop

T1543.003Create or Modify System Process: Windows Service

T1564.004Hide Artifacts: NTFS File Attributes

T1574.011Hijack Execution Flow: Services Registry Permissions Weakness

T1685Disable or Modify Tools

Is it the real sc.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionService Control Manager Configuration Tool

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sc.exe · signed by Microsoft Windows

3dfd292a4ae6bfd43b7796b009198d1f7b9342b14acd0a20613ef0fe0dd0cbd8

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sc.exe · signed by Microsoft Windows

8a5410d1a08fcc5cf03b9ce98e62e0049e8e8295cd35b845eebdc882ca657bc1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sc.exe · signed by Microsoft Windows

41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sc.exe · signed by Microsoft Windows

4fe6d9eb8109fb79ff645138de7cff37906867aade589bd68afa503a9ab3cfb2

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sc.exe · signed by Microsoft Windows

23e7f413deb59eec7f0769c44c35dd332e2c9838e79bc05eb3ee9d653269e614

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sc.exe · signed by Microsoft Windows

39c59c362649090b4d34e5c8221c6e86552c07fe2df3478d591a68b70917bc0a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sc.exe · signed by Microsoft Windows

604492b8398751f0798079cec26d674c125885f55b2beab1bc484ebdb723bb63

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\sc.exe · signed by Microsoft Windows

78097c7cd0e57902536c60b7fa17528c313db20869e5f944223a0ba4c801d39b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\sc.exe · signed by Microsoft Windows

8a775b86ce1a057e290ccd26c59c96070684468a3119790743a346cd54f4dfdf

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\sc.exe · signed by Microsoft Windows

b6ce75e1d5b462cf6814c917d294232e8b83083539e6898ee2deac009f60e56d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\sc.exe · not signed

b20bbd7b8b5707acc00d7c51ef79771f22f2e201d4844252b675058ebea9e416

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\sc.exe · not signed

ed168045d0402e26305699442fc2b019b9967ca401e084748a763e8f08a5651c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Show the status of a service (no service name will list all services)

sc query service_nameIdentify

Trips 1 Sigma rule: lowSC.EXE Query Execution by frack113

Start a service asynchronously

sc start service_nameIdentify

Stop a service asynchronously

sc stop service_nameIdentify

Trips 1 Sigma rule: lowStop Windows Service Via Sc.EXE by Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Of the 3 examples the identifier reads, 2 match LOLBAS abuse or trip a Sigma process-creation rule.