combining these is relatively straightforward:
(((unique value of (substring between "%22" of it) of image path of it) | (unique value of (preceding text of first " " of it) of image path of it)) | image path of it) of services
This relevance returns a list of paths of services that we can then use with file to check the security descriptors
service names of services whose ((effective write permission for "Authenticated Users" of dacl of security descriptor of file of it) = true)
Now for combining them. Basically we are just going to replace the reference to of it in this clause with everything but the final of services from our service path relevance from above. Let’s expand out the relevance to make this more clear:
service names of services whose ((effective write permission for "Authenticated Users" of dacl of security descriptor of file
of it
) = true)
We are just going to replace the reference to of it in this clause with everything but the final of services from our service path relevance from above.
service names of services whose ((effective write permission for "Authenticated Users" of dacl of security descriptor of file
(((unique value of (substring between "%22" of it) of image path of it) | (unique value of (preceding text of first " " of it) of image path of it)) | image path of it)
) = true)
Give that a shot!
Other method
If I was writing this in my preferred method it would end up looking like this (test using single clause tab of qna):
items 0 of
it
whose (
(effective write permission for "Authenticated Users" of dacl of security descriptor of file (item 1 of it)) = true
)
of
(
service name of it,
((unique value of (substring between "%22" of it) of image path of it) | (unique value of (preceding text of first " " of it) of image path of it)) | image path of it
)
of services
I think good relevance is most easily read backwards so this is in three parts and we will start from the services reference at the end of the relevance and work our way back to the start.
The later part of the relevance
(
service name of it,
((unique value of (substring between "%22" of it) of image path of it) | (unique value of (preceding text of first " " of it) of image path of it)) | image path of it
)
of services
returns a list of tuples where the first part is the service name and the second part is our parsed path:
Current Selection Evaluates To:
AJRouter, C:\Windows\system32\svchost.exe
ALG, C:\Windows\System32\alg.exe
AppIDSvc, C:\Windows\system32\svchost.exe
Appinfo, C:\Windows\system32\svchost.exe
AppMgmt, C:\Windows\system32\svchost.exe
The middle part of the relevance:
it
whose (
(effective write permission for "Authenticated Users" of dacl of security descriptor of file (item 1 of it)) = true
)
of <first part>
Reading backwards we start with (from the first section of relevance) a list of tuples where the first part is the service name and the second part is our parsed path. We then use it whose () of to filter the first part, filtering on our permissions check. From this we return a list of tuples where the first part is the service name and the second part is our parsed path but, as previously mentioned filtered using our whose clause that does our permissions check.
Current Selection Evaluates To:
jhi_service, C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_b5484efd38adbe8d\jhi_service.exe
WMIRegistrationService, C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_cad1db73e8c782a6\WMIRegistrationService.exe
The first part of the relevance:
items 0 of
simply returns the service name from the tuple, dropping the path.
Current Selection Evaluates To:
jhi_service
WMIRegistrationService
I like this format for a couple of reasons. I like the clear separation of parsing logic from filtering logic. I like that I could really easily modify my parsing logic and not feel like im playing with a firey pile of spaghetti. I like that I could easily locate and change my security permission filtering. I like that I could easily return a different field from the service or multiple fields from the service. I just wish the console would let you keep the formatting in every circumstance instead of just some of them.
