Windows Service ACLs

Windows services and remoting endpoints are secured by security descriptors — ACLs that govern who can connect, query, start, stop, or reconfigure them — independent of the privileges assigned to any particular user account. Manipulating a service’s ACL rather than group membership is a subtle persistence and privilege-granting technique: the user never appears in a privileged group, so standard admin-group auditing misses the backdoor.

Example: WinRM / PowerShell Remoting

The Microsoft.PowerShell session configuration controls who may connect over WinRM (Windows Remote Management). Granting a user Full Control on its security descriptor enables WinRM access regardless of the user’s explicit privileges:

# Opens the GUI ACL editor for the session configuration
Set-PSSessionConfiguration -Name Microsoft.PowerShell -ShowSecurityDescriptorUI

Per Microsoft Learn¹, the equivalent scriptable form is -SecurityDescriptorSddl <SDDL string>; users need at least Execute(Invoke) on the configuration to use it.

Service control ACLs

Individual services also carry security descriptors (readable with sc.exe sdshow, writable with sc.exe sdset in SDDL). Granting a low-privileged user SERVICE_CHANGE_CONFIG on a privileged service converts it into an escalation primitive — reconfigure the binary path and restart. See exploit-windows-services for the full attack path and query-windows-service-configuration for enumeration.

Why attackers prefer ACL edits over group edits

• Group membership changes fire high-visibility events (4728/4732/4756) and are reviewed routinely
• ACL changes on services and session configurations are comparatively obscure
• The backdoored principal retains normal-looking group memberships

Defense

• Baseline and monitor security descriptors on critical services and PowerShell session configurations
• Alert on sc.exe sdset and Set-PSSessionConfiguration execution
• See windows-event-logs for service-related event IDs

Sources

• Microsoft Learn — Set-PSSessionConfiguration
• Microsoft Learn — Service security and access rights
• MITRE ATT&CK T1543.003 — Windows Service

Related: exploit-windows-services, windows-services, query-windows-service-configuration, icacls, windows-ntfs-permissions

Footnotes

1. Set-PSSessionConfiguration — Microsoft Learn ↩