detection.wiki

System Services T1569

Tactic: Execution

Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence (Create or Modify System Process), but adversaries can also abuse services for one-time or temporary execution.

Events covered

23 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 3Network connection
SysmonEvent ID 5Process terminated
SysmonEvent ID 7Image loaded
SysmonEvent ID 11FileCreate
SysmonEvent ID 12RegistryEvent (Object create and delete)
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 14RegistryEvent (Key and Value Rename)
SysmonEvent ID 17PipeEvent (Pipe Created)
SysmonEvent ID 18PipeEvent (Pipe Connected)
Security-AuditingEvent ID 4624An account was successfully logged on.
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 4689A process has exited.
Security-AuditingEvent ID 4697A service was installed in the system.
Security-AuditingEvent ID 5145A network share object was checked to see whether client can be granted desired access.
Defender-DeviceProcessEventsanyProcess activity (any)
ESFexecProcess Execution (Notify)
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).
PrintServiceEvent ID 316Printer driver param1 for param2 param3 was added or updated.
PrintServiceEvent ID 808The print spooler failed to load a plug-in module PluginDllName, error code ErrorCode.
Windows-DefenderEvent ID 1121Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
Service-Control-ManagerEvent ID 7036The Microsoft Software Shadow Copy Provider service entered the stopped state.
Service-Control-ManagerEvent ID 7045A service was installed in the system.

Authoring guide

Patterns shared across the 102 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (86 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine22contains 11, regex_match 8, eq 1, in 1, is_not_null 1, match 1(?i)((\.exe(\")?(\s+|\s+\/c)\s+)|(psexec.{1,}))|(\"{1,})?..., (?i)sc(\.exe)?\s(.+)?create\s, /account=system , /account=ti , exec
EventID19eq 197045, 4688, 1, 4697, 4104
Image16ends_with 10, eq 3, contains 2, is_not_null 1/launchctl, /usr/bin/systemctl, :\users\public\, :\windows\temp\, ?:\windows\system32\svchost.exe
ServiceName14eq 9, contains 3, starts_with 2, regex_match 1PSEXESVC, ammyyadmin, atera, (^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$), BTOBTO
ImagePath12contains 6, ends_with 5, match 2, regex_match 1, starts_with 1.exe, %comspec%, .bat & del , ADMIN$, C:\WINDOWS\PAExec-
OriginalFileName12eq 12psexec.c, sc.exe, net.exe, net1.exe, nircmd.exe
Provider_Name12eq 12Service Control Manager
process_name12eq 9, ends_with 1, in 1, ne 1sc.exe, cmd.exe, psexec.exe, \psexesvc.exe, \wmiprvse.exe
event.type11eq 10, in 1start, change, process_started
Channel6eq 6, in 6
eventtype6eq 6
parent_process_name6eq 4, ends_with 1, match 1services.exe, (?i)(\w{8}\.exe)|(psexec), \PSEXESVC.exe, cmd.exe, mshta.exe
PipeName5contains 2, eq 2, starts_with 1\PSEXESVC, \PAExec, \csexecsvc, \remcom
process.args5eq 4, in 1, starts_with 1-accepteula, \\, binPath=, binpath=, config
RelativeTargetName4eq 4svcctl, spoolss

Top indicator values (599 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
Provider_Nameeq
Service Control Manager
1250
EventIDeq
7045
1020
EventIDeq
4688
6313
EventIDeq
1
2237
EventIDeq
4697
22
event.typeeq
start
9606
process_nameeq
sc.exe
429
AccessListcontains
%%4417
311
OriginalFileNameeq
psexec.c
36
OriginalFileNameeq
sc.exe
326
RelativeTargetNameeq
svcctl
36
ShareNamewildcard
\\*\IPC$
311
event.categoryeq
process
3128
CommandLineregex_match
(?i)((\.exe(\")?(\s+|\s+\/c)\s+)|(psexec.{1,}))|(\"{1,})?\x5c\x5c.{2,}
22
CommandLineregex_match
(?i)sc(\.exe)?\s(.+)?create\s
22
Detailscontains
powershell
210
ImagePathcontains
powershell
25
PipeNameeq
\PSEXESVC
22
ProviderNameeq
MDATP
213
ServiceFileNamecontains
powershell
24
ServiceNamecontains
ammyyadmin
22
ServiceNamecontains
atera
22
ServiceNamecontains
basupportexpresssrvcupdater
22
ServiceNamecontains
basupportexpressstandaloneservice
22
ServiceNamecontains
chromoting
22
ServiceNamecontains
gotoassist
22
ServiceNamecontains
gotomypc
22
ServiceNamecontains
jumpcloud
22
ServiceNamecontains
lmiguardiansvc
22
ServiceNamecontains
logmein
22

Exclusions (155 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
SubjectUserNameends_with
$
2
CommandLineeq
"cmd.exe" /C sc control hptpsmarthealthservice 211
1
Detailswildcard
%SystemRoot%\system32\svchost.exe -k *
1
Detailswildcard
%systemroot%\system32\*.exe
1
Detailswildcard
%windir%\system32\*.exe
1
Detailswildcard
%windir%\system32\svchost.exe -k *
1
Detailswildcard
?:\Windows\system32\*.exe
1
EventDatacontains
gc_service.exe
1
EventDatacontains
gc_worker.exe
1
Hasheseq
214c75f678bc596bbe667a3b520aaaf09a0e50c364a28ac738a02f867a085eba
1
Hasheseq
23aa95b637a1bf6188b386c21c4e87967ede80242327c55447a5bb70d9439244
1
Hasheseq
3ed33e71641645367442e65dca6dab0d326b22b48ef9a4c2a2488e67383aa9a6
1
Hasheseq
5050b025909e81ae5481db37beb807a80c52fc6dd30c8aa47c9f7841e2a31be7
1
Hasheseq
b4db053f6032964df1b254ac44cb995ffaeb4f3ade09597670aba4f172cf65e4
1
Imageends_with
\system32\conhost.exe
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 56 rules

Elastic 15 rules

Splunk 26 rules

Kusto 5 rules