Detection rules › By event

Service-Control-Manager

Event	Rules
Event ID 7000	1
Event ID 7009	1
Event ID 7023	2
Event ID 7034	1
Event ID 7036	6
Event ID 7040	3
Event ID 7045	76

Event ID 7000

1 detection rules reference this event. View event page.

Sigma (1)

Massive service failures - Tchopper severity high T1569

Event ID 7009

1 detection rules reference this event. View event page.

Sigma (1)

Massive service failures - Tchopper severity high T1569

Event ID 7023

2 detection rules reference this event. View event page.

Sigma (2)

Important Windows Service Terminated With Error severity high
Windows Service Terminated With Error severity low

Event ID 7034

1 detection rules reference this event. View event page.

Sigma (1)

Important Windows Service Terminated Unexpectedly severity high

Event ID 7036

6 detection rules reference this event. View event page.

Sigma (3)

HackTool Service Registration or Execution severity high T1569, T1569.002
Remote Access Tool Services Have Been Installed - System severity medium T1543, T1543.003, T1569, T1569.002
Windows Defender Threat Detection Service Disabled severity medium T1685

Splunk (3)

First Time Seen Running Windows Service severity low T1569, T1569.002
Windows Cisco Secure Endpoint Related Service Stopped severity low T1490
Windows Security And Backup Services Stop severity medium T1490

Event ID 7040

3 detection rules reference this event. View event page.

Splunk (3)

Windows Event For Service Disabled T1685
Windows Excessive Disabled Services Event severity medium T1685
Windows Service Stop Win Updates severity low T1489

Event ID 7045

76 detection rules reference this event. View event page.

Sigma (55)

Anydesk Remote Access Software Service Installation severity medium
CobaltStrike Service Installations - System severity critical T1021, T1021.002, T1543, T1543.003, T1569, T1569.002
COLDSTEEL Persistence Service Creation severity high
Credential Dumping Tools Service Execution - System severity high T1003, T1003.001, T1003.002, T1003.004, T1003.005, T1003.006
CSExec Service Installation severity medium T1569, T1569.002
Encoded PowerShell payload deployed via service severity high T1027, T1543, T1543.003
Goofy Guineapig Backdoor Service Creation severity critical
HackTool Service Registration or Execution severity high T1569, T1569.002
Impacket SMBexec service registration (native) severity high T1112, T1543, T1543.003
Invoke-Obfuscation CLIP+ Launcher - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION - System severity medium T1027, T1059, T1059.001
Invoke-Obfuscation Obfuscated IEX Invocation - System severity high T1027
Invoke-Obfuscation RUNDLL LAUNCHER - System severity medium T1027, T1059, T1059.001
Invoke-Obfuscation STDIN+ Launcher - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation VAR+ Launcher - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation Via Stdin - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation Via Use Clip - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation Via Use MSHTA - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation Via Use Rundll32 - System severity high T1027, T1059, T1059.001
KrbRelayUp Service Installation severity high T1543
KrbRelayUp service installation (native) severity high T1569
Massive service installation - Tchopper severity high T1569
Mesh Agent Service Installation severity medium T1219, T1219.002
Meterpreter or Cobalt Strike Getsystem Service Installation - System severity high T1134, T1134.001, T1134.002
Mimikatz driver deployed via service severity high T1543, T1543.003
Moriya Rootkit - System severity critical T1543, T1543.003
NetSupport Manager Service Install severity medium
New PDQDeploy Service - Client Side severity medium T1543, T1543.003
New PDQDeploy Service - Server Side severity medium T1543, T1543.003
OilRig APT Schedule Task Persistence - System severity critical T1053, T1053.005, T1071, T1071.004, T1112, T1543
PAExec Service Installation severity medium T1569, T1569.002
PowerShell Scripts Installed as Services severity high T1569, T1569.002
ProcessHacker Privilege Elevation severity high T1543, T1543.003, T1569, T1569.002
PsExec Service Installation severity medium T1569, T1569.002
PSexec service installation severity medium T1543, T1543.003
RDP session hijack via service creation abuse severity high T1543, T1543.003, T1563, T1563.002
RemCom Service Installation severity medium T1569, T1569.002
Remote Access Tool Services Have Been Installed - System severity medium T1543, T1543.003, T1569, T1569.002
Remote Utilities Host Service Install severity medium
RTCore Suspicious Service Installation severity high
Service Installation in Suspicious Folder severity medium T1543, T1543.003
Service Installation with Suspicious Folder Pattern severity high T1543, T1543.003
Service Installed By Unusual Client - System severity high T1543
Sliver C2 Default Service Installation severity high T1543, T1543.003, T1569, T1569.002
smbexec.py Service Installation severity high T1021, T1021.002, T1569, T1569.002
SNAKE Malware Service Persistence severity critical
StoneDrill Service Install severity high T1543, T1543.003
Suspicious Service Installation severity high T1543, T1543.003
Suspicious Service Installation Script severity high T1543, T1543.003
TacticalRMM Service Installation severity medium T1219, T1219.002
Tap Driver Installation severity medium T1048
Turla PNG Dropper Service severity critical T1543, T1543.003
Turla Service Install severity high T1543, T1543.003
Uncommon Service Installation Image Path severity medium T1543, T1543.003

Elastic (1)

Suspicious Service was Installed in the System severity medium T1543, T1543.003, T1569, T1569.002

Splunk (18)

Clop Ransomware Known Service Name severity medium T1543
Impacket SMBexec (Windows Event Log) T1021, T1021.006, T1059, T1569, T1569.002
Kernel Service Installed - Windows (Windows Event Log) T1068, T1543, T1543.003
Malicious Powershell Executed As A Service severity medium T1569, T1569.002
PSexec Service Creation (Windows Event Log) T1543, T1543.003, T1569, T1569.002
Randomly Generated Windows Service Name T1543, T1543.003
Service Created containing Command Shell (Windows Event Log) T1569, T1569.002
Service Installed (Windows Event Log) T1543, T1569
SimpleHelp Remote Access Tool Service Installation (Windows Event Log) T1219, T1543, T1569, T1569.002
Windows Bluetooth Service Installed From Uncommon Location severity low T1036, T1543, T1543.003
Windows Driver Load Non-Standard Path severity medium T1014, T1068
Windows KrbRelayUp Service Creation severity medium T1543, T1543.003
Windows Service Create RemComSvc severity low T1543, T1543.003
Windows Service Create SliverC2 severity medium T1569, T1569.002
Windows Service Created with Suspicious Service Name severity low T1569, T1569.002
Windows Service Created with Suspicious Service Path severity medium T1569, T1569.002
Windows Snake Malware Service Create severity medium T1547, T1547.006, T1569, T1569.002
Windows Vulnerable Driver Installed severity medium T1543, T1543.003

Kusto (1)

Credential Dumping Tools - Service Installation severity high T1003, T1003.001

YARA-L (1)

Suspicious Windows Service Installation Detected T1543, T1543.003