feat: susp service priv esc and phantom hijack rules

[swachchhanda000]

Summary of the Pull Request

Changelog

new - Service StartType Change for Services Vulnerable to Phantom DLL Hijacking
update - Potential DLL Sideloading Of Non-Existent DLLs From System Folders
new - Suspicious Service Privilege Addition
new - Suspicious Privilege Addition To Existing Service

Example Log Event

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" /> 
  <EventID Qualifiers="16384">7040</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8080000000000000</Keywords> 
  <TimeCreated SystemTime="2025-09-08T05:22:22.9483038Z" /> 
  <EventRecordID>2011</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="836" ThreadID="12500" /> 
  <Channel>System</Channel> 
  <Computer>swachchhanda</Computer> 
  <Security UserID="S-1-5-21-2555720767-1205513275-3893774561-1001" /> 
  </System>
- <EventData>
  <Data Name="param1">Remote Desktop Configuration</Data> 
  <Data Name="param2">demand start</Data> 
  <Data Name="param3">auto start</Data> 
  <Data Name="param4">SessionEnv</Data> 
  </EventData>
  </Event>

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[Copilot]

Pull Request Overview

This PR adds new detection rules for suspicious service privilege modifications and phantom DLL hijacking techniques that threat actors use for privilege escalation and EDR bypass. The changes focus on detecting malicious service configuration changes that could be used to load kernel drivers or perform DLL sideloading attacks.

• Four new rules for detecting service privilege additions and phantom DLL hijacking abuse
• One update to an existing image load rule to add correlation with new phantom DLL hijacking rules

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
registry_set_susp_service_privilege_addition.yml	New registry-based detection for suspicious privilege additions to services
proc_creation_win_susp_service_privilege_addition.yml	New process-based detection for suspicious service privilege modifications
proc_creation_win_sc_service_config_change_for_phatom_dll_hijacking.yml	New detection for SC.EXE configuration changes on vulnerable services
win_system_service_starttype_change_for_phatom_dll_abuse.yml	New detection for service start type changes on phantom DLL vulnerable services
image_load_side_load_non_existent_dlls.yml	Updated to include correlation with new phantom DLL hijacking rule

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Inconsistent spelling: the title correctly uses 'Phantom' while the description uses 'phatom'. The filename also uses 'phatom' instead of 'phantom'.

[Copilot]

Filename contains spelling error: 'phatom' should be 'phantom' to match the correctly spelled title.

[Copilot]

The rule references itself in the related section (line 4 uses the same ID as line 2). This creates a self-reference which is not meaningful.

Suggested change

	related:
	- id: ad682e11-8144-4de0-aa39-1cfcd5ebb64e
	type: similar

[phantinuss]

you could add Param3 for matching on switching to "on demand" and "auto start" only.

[phantinuss]

Suggested change

	Detects the use of SC.EXE to modify configurations of known services that have been abused by threat actors for phantom dll hijacking.
	Since, these services load the phatom dlls, threat actors may modify their configurations to load malicious dlls instead at runtime.
	Detects the use of SC.EXE to modify configurations of known services that have been abused by threat actors for phantom DLL hijacking.
	Since, these services load the phantom DLLs, threat actors may modify their configurations to load malicious DLLs instead at runtime.

[phantinuss]

Suggested change

	# Add other services vulnerable to phantom dll hijacking
	# Add other services vulnerable to phantom DLL hijacking