Suspicious Service ImagePath Value

[rule]
description = """
Identifies the creation of a Windows service with a suspicious ImagePath value. Adversaries may use this technique to
maintain persistence or run with System privileges.
"""
id = "d6bb94ed-3df3-426f-8274-f6c4fb9b864d"
license = "Elastic License v2"
name = "Suspicious Service ImagePath Value"
os_list = ["windows"]
version = "1.0.18"

query = '''
registry where registry.path : "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\ImagePath" and

   registry.data.strings != null and

   registry.data.strings : ("*COMSPEC*", "*\\172.0.0.1*", "*Admin$*", "*powershell*", "*rundll32*", "*NTDS\\ntds.dit*",
                            "*HarddiskVolumeShadowCopy*") and

   not registry.data.strings :
                     ("?:\\Windows\\system32\\rundll32.exe ?:\\Windows\\SYSTEM32\\INTERP~2.DLL,eb_service",
                      "%SystemRoot%\\System32\\rundll32.exe \"C:\\Windows\\Downloaded Program Files\\urxdialer.dll\",EmergencyCleanup",
                      "%COMSPEC% /Q /c start*pzaS5TZXJ2aWNlTmFtZSA9ICJPMjRBVVRIIjs*",
                      "\"C:\\Program Files (x86)\\*", "\"C:\\Program Files\\*")
'''

actions = []
min_endpoint_version = "8.4.0"
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.4.0"