corpus.blog
41,832 blogs · 5,239,565 posts Claim your blog
Record · corpus.blog/posts/01a08780-91a5-726b-b087-c80f42a6ede9

Using EDR telemetry for offensive research - part 2 - service SDDLs

hackingiscool.pl · published 31 March 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at hackingiscool.pl Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
13
Words captured
2,237

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-string-format
learn.microsoft.com
https://learn.microsoft.com/en-us/previous-versions/windows/desktop/secrcw32prov/binarysdtosddl-method-in-class-win32-securitydescriptorhelper
learn.microsoft.com
https://github.com/ewilded/Service_SDDLs/blob/main/print_SDDL.ps1
github.com
https://github.com/tpn/winsdk-10/blob/master/Include/10.0.14393.0/shared/sddl.h
github.com
https://doxygen.reactos.org/d2/d0e/sddl_8h.html
doxygen.reactos.org
https://community.cyberark.com/s/article/What-permissions-are-required-for-the-CPM-to-manage-Windows-services
community.cyberark.com
https://github.com/ewilded/Service_SDDLs/blob/main/create_service.cpp
github.com
https://github.com/ewilded/Service_SDDLs/blob/main/change_service_config.cpp
github.com
https://github.com/ewilded/Service_SDDLs/blob/main/check_SDDLs.ps1
github.com
https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/services/service-security-and-access-rights
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-controlservice
learn.microsoft.com
Elsewhere on hackingiscool.pl (1)