Suspicious Windows Service DLL Creation

[rule]
description = """
Identifies the creation of a new service via ServiceDLL registry modification instead of using the Windows Service
Control Manager APIs, subsequently loaded by svchost.exe. Adversaries may use this technique to maintain persistence or
run with System privileges.
"""
id = "2c624716-75a1-42d9-bcb8-1defcb9bded9"
license = "Elastic License v2"
name = "Suspicious Windows Service DLL Creation"
os_list = ["windows"]
version = "1.0.36"

query = '''
registry where event.action == "modification" and 
 registry.value : "ServiceDLL" and process.executable : ("?:\\*", "\\Device\\Mup\\*") and
 not process.executable : ("?:\\Windows\\System32\\services.exe",
                           "?:\\Windows\\System32\\msiexec.exe",
                           "?:\\Windows\\SysWOW64\\msiexec.exe",
                           "?:\\Windows\\System32\\poqexec.exe",
                           "?:\\Windows\\System32\\w32tm.exe",
                           "?:\\Windows\\System32\\spoolsv.exe",
                           "?:\\Windows\\servicing\\TrustedInstaller.exe",
                           "?:\\Windows\\System32\\sdiagnhost.exe",
                           "?:\\Windows\\WinSxS\\*\\TiWorker.exe",
                           "?:\\Windows\\System32\\drvinst.exe",
                           "?:\\Program Files (x86)\\*.exe",
                           "?:\\Program Files\\*.exe",
                           "?:\\Windows\\Temp\\*-*-*\\DismHost.exe",
                           "?:\\$WINDOWS.~BT\\Work\\*\\DismHost.exe",
                           "?:\\$WinREAgent\\Scratch\\*\\DismHost.exe",
                           "?:\\Windows\\SoftwareDistribution\\*.exe",
                           "?:\\Windows\\regedit.exe",
                           "?:\\Windows\\System32\\reg.exe",
                           "?:\\Windows\\System32\\lsass.exe",
                           "?:\\Windows\\System32\\upfc.exe",
                           "?:\\Windows\\System32\\SearchProtocolHost.exe",
                           "?:\\Windows\\SystemApps\\Microsoft.Windows.Search_*\\SearchApp.exe",
                           "?:\\Windows\\System32\\conhost.exe",
                           "?:\\Windows\\System32\\oobe\\UserOOBEBroker.exe",
                           "?:\\Windows\\CCM\\SCNotification.exe",
                           "?:\\Windows\\System32\\PrintIsolationHost.exe",
                           "?:\\Windows\\System32\\sppsvc.exe",
                           "?:\\Windows\\System32\\backgroundTaskHost.exe",
                           "?:\\*\\procexp64.exe",
                           "C:\\Windows\\SystemTemp\\*\\DismHost.exe") and

 not (process.executable : ("?:\\Windows\\System32\\svchost.exe",
                            "?:\\Windows\\System32\\regsvr32.exe",
                            "?:\\Windows\\SysWOW64\\regsvr32.exe",
                            "?:\\Users\\*\\AppData\\Local\\Temp\\*\\DismHost.exe",
                            "?:\\Windows\\Temp\\osrssinst.exe",
                            "?:\\Windows\\regedit.exe",
                            "?:\\$WINDOWS.~BT\\Work\\*\\DismHost.exe") and
      registry.data.strings : ("%systemroot%\\system32\\*", "?:\\Windows\\System32\\*", "%systemroot%\\syswow64\\*",
                               "?:\\Windows\\SysWOW64\\*", "*:\\Program Files\\*", "*:\\Program Files (x86)\\*")) and

 not registry.data.strings : "?:\\WINDOWS\\system32\\spool\\drivers\\x64\\3\\PrintConfig.dll" and

 not (registry.data.strings : "?:\\Program Files (x86)\\dolphinpaper\\provider\\wpprovider.dll" and
      registry.path : "HKLM\\SYSTEM\\ControlSet*\\Services\\dolphinSvc\\Parameters\\ServiceDll") and

 not (process.code_signature.subject_name : ("Speckled Jay LLC", "Refraction Point, Inc", "Arcadia Laboratories Inc.") and process.code_signature.trusted == true) and

 not (process.name : "Dismhost.exe" and registry.data.strings : ("%systemroot%\\system32\\wuaueng.dll", "%SystemRoot%\\System32\\browser.dll") and
      process.code_signature.subject_name : "Microsoft*" and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.1.0"