TermService ServiceDll hijack
The DLL backing a core Windows service was repointed in the registry.
What it detects
The DLL backing a core Windows service was repointed in the registry. A service's Parameters\ServiceDll value names the code svchost.exe loads for it, so rewriting it substitutes attacker code into a SYSTEM process that starts automatically at boot — persistence, privilege and a legitimate-looking parent in one edit.
Terminal Services is the case seen most often in the wild, because rewriting its ServiceDll is how RDP-patching tools enable concurrent remote sessions on editions that do not permit them. That is also how an intruder gives themselves durable remote access to a workstation someone else is sitting at.
MITRE ATT&CK mapping
False positives and triage
Windows servicing does update these values during genuine OS updates, in which case the writing process is TiWorker.exe or TrustedInstaller.exe and the new path stays inside C:\Windows\System32.
To confirm: read Details= for the new DLL path. Anything outside System32 — Program Files\RDP Wrapper, \ProgramData\, a user directory — is the finding. Verify the DLL's signature and hash, and check whether the service was restarted just afterwards, which is when the substituted code actually started running. If this is an RDP wrapper, confirm with the owner whether concurrent RDP was an approved change; if not, treat every subsequent RDP session on that host as suspect.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/windows/termservice_servicedll_hijack.yaml, licensed under the Apache License 2.0.
id: windows.defense_evasion.termservice_servicedll_hijack
version: 1.0.0
status: stable
severity: critical
confidence: 0.85
platforms: [windows]
mitre_techniques: [T1543.003, T1112]
description: |
The DLL backing a core Windows service was repointed in the registry. A service's
`Parameters\ServiceDll` value names the code `svchost.exe` loads for it, so
rewriting it substitutes attacker code into a SYSTEM process that starts
automatically at boot — persistence, privilege and a legitimate-looking parent in
one edit.
Terminal Services is the case seen most often in the wild, because rewriting its
ServiceDll is how RDP-patching tools enable concurrent remote sessions on editions
that do not permit them. That is also how an intruder gives themselves durable
remote access to a workstation someone else is sitting at.
match:
registry_path_regex: '(?i)\\services\\(termservice|remoteaccess|sessionenv|umrdpservice|w32time|schedule|winmgmt|browser|iphlpsvc|dnscache)\\parameters\\servicedll'
correlation_keys: [hostname]
false_positive_guidance: |
Windows servicing does update these values during genuine OS updates, in which case
the writing process is `TiWorker.exe` or `TrustedInstaller.exe` and the new path
stays inside `C:\Windows\System32`.
To confirm: read `Details=` for the new DLL path. Anything outside System32 —
`Program Files\RDP Wrapper`, `\ProgramData\`, a user directory — is the finding.
Verify the DLL's signature and hash, and check whether the service was restarted
just afterwards, which is when the substituted code actually started running.
If this is an RDP wrapper, confirm with the owner whether concurrent RDP was an
approved change; if not, treat every subsequent RDP session on that host as suspect.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.