AgtaBackupAgentSvc service SDDL locked to SYSTEM-only access

Ankit Mehta@Secvyn

•updated 9 days ago•1•0•2

Detects the modification of service permissions for the 'AgtaBackupAgentSvc' service using the 'sdset' command via 'sc.exe', 'cmd.exe', or 'powershell.exe'. Adversaries use this technique to hide services or modify access to them by applying a specific Service Descriptor Definition Language (SDDL) string to bypass security enumeration or maintain persistence.