Service Installed by an Unusual Microsoft Signed Process

[rule]
description = """
Identifies the install of a new service by an unusual Microsoft signed program or an executable from a world user
writable path. Adversaries may use this technique to maintain persistence or run with System privileges.
"""
id = "07f2c66e-46e3-4ce2-aca1-291172fc88fc"
license = "Elastic License v2"
name = "Service Installed by an Unusual Microsoft Signed Process"
os_list = ["windows"]
version = "1.0.3"

query = '''
any where event.category == "configuration" and event.action == "service_installed" and user.id != "S-1-5-18" and
  process.code_signature.subject_name == "Microsoft Windows" and
  not winlog.event_data.ServiceStartType in ("Manual", "Disabled") and
  not process.executable : ("?:\\Windows\\Sys?????\\sc.exe",
                             "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\setup.exe",
                             "C:\\Windows\\Microsoft.NET\\Framework\\v*\\InstallUtil.exe",
                             "C:\\Program Files\\Microsoft SQL Server\\*\\ScenarioEngine.exe",
                             "C:\\Windows\\System32\\wsmprovhost.exe",
                             "C:\\Windows\\Sys?????\\msiexec.exe",
                             "C:\\Program Files\\Microsoft\\AzureAttestService\\AzureAttestServiceInstaller.exe",
                             "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
                             "C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe",
                             "C:\\Program Files\\Microsoft Office\\root\\Integration\\Addons\\OneDriveSetup.exe",
                             "C:\\Program Files (x86)\\AOMEI Cyber Backup\\x64\\InstallUtil.exe",
                             "C:\\Windows\\Microsoft.NET\\Framework64\\*\\InstallUtil.exe",
                             "C:\\Program Files (x86)\\AOMEI Cyber Backup\\x64\\iscsi\\InstallUtil.exe",
                             "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe") and
   not (process.parent.executable : ("C:\\Windows\\Sys?????\\msiexec.exe", "C:\\Program Files\\Wireshark\\USBPcapSetup-*.exe", "C:\\Program Files (x86)\\AOMEI Cyber Backup\\x64\\AOMEIImgService.exe") and
        process.executable : "?:\\Windows\\Sys?????\\rundll32.exe") and
   not process.parent.executable : ("F:\\setup.exe") and
   not process.command_line : ("\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ",
                               "\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy UnRestricted -File *") and 
   not (process.executable : "?:\\Windows\\System32\\dllhost.exe" and
        process.command_line :  "C:\\Windows\\system32\\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}" and
        process.parent.executable : "C:\\Windows\\System32\\services.exe")
'''

min_endpoint_version = "9.0.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "9.0.0"