Detection rules › By event

Service-Control-Manager Event ID 7045

76 detection rules reference this event. View event page.

Sigma (55)

Anydesk Remote Access Software Service Installation severity medium
CobaltStrike Service Installations - System severity critical T1021, T1021.002, T1543, T1543.003, T1569, T1569.002
COLDSTEEL Persistence Service Creation severity high
Credential Dumping Tools Service Execution - System severity high T1003, T1003.001, T1003.002, T1003.004, T1003.005, T1003.006
CSExec Service Installation severity medium T1569, T1569.002
Encoded PowerShell payload deployed via service severity high T1027, T1543, T1543.003
Goofy Guineapig Backdoor Service Creation severity critical
HackTool Service Registration or Execution severity high T1569, T1569.002
Impacket SMBexec service registration (native) severity high T1112, T1543, T1543.003
Invoke-Obfuscation CLIP+ Launcher - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION - System severity medium T1027, T1059, T1059.001
Invoke-Obfuscation Obfuscated IEX Invocation - System severity high T1027
Invoke-Obfuscation RUNDLL LAUNCHER - System severity medium T1027, T1059, T1059.001
Invoke-Obfuscation STDIN+ Launcher - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation VAR+ Launcher - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation Via Stdin - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation Via Use Clip - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation Via Use MSHTA - System severity high T1027, T1059, T1059.001
Invoke-Obfuscation Via Use Rundll32 - System severity high T1027, T1059, T1059.001
KrbRelayUp Service Installation severity high T1543
KrbRelayUp service installation (native) severity high T1569
Massive service installation - Tchopper severity high T1569
Mesh Agent Service Installation severity medium T1219, T1219.002
Meterpreter or Cobalt Strike Getsystem Service Installation - System severity high T1134, T1134.001, T1134.002
Mimikatz driver deployed via service severity high T1543, T1543.003
Moriya Rootkit - System severity critical T1543, T1543.003
NetSupport Manager Service Install severity medium
New PDQDeploy Service - Client Side severity medium T1543, T1543.003
New PDQDeploy Service - Server Side severity medium T1543, T1543.003
OilRig APT Schedule Task Persistence - System severity critical T1053, T1053.005, T1071, T1071.004, T1112, T1543
PAExec Service Installation severity medium T1569, T1569.002
PowerShell Scripts Installed as Services severity high T1569, T1569.002
ProcessHacker Privilege Elevation severity high T1543, T1543.003, T1569, T1569.002
PsExec Service Installation severity medium T1569, T1569.002
PSexec service installation severity medium T1543, T1543.003
RDP session hijack via service creation abuse severity high T1543, T1543.003, T1563, T1563.002
RemCom Service Installation severity medium T1569, T1569.002
Remote Access Tool Services Have Been Installed - System severity medium T1543, T1543.003, T1569, T1569.002
Remote Utilities Host Service Install severity medium
RTCore Suspicious Service Installation severity high
Service Installation in Suspicious Folder severity medium T1543, T1543.003
Service Installation with Suspicious Folder Pattern severity high T1543, T1543.003
Service Installed By Unusual Client - System severity high T1543
Sliver C2 Default Service Installation severity high T1543, T1543.003, T1569, T1569.002
smbexec.py Service Installation severity high T1021, T1021.002, T1569, T1569.002
SNAKE Malware Service Persistence severity critical
StoneDrill Service Install severity high T1543, T1543.003
Suspicious Service Installation severity high T1543, T1543.003
Suspicious Service Installation Script severity high T1543, T1543.003
TacticalRMM Service Installation severity medium T1219, T1219.002
Tap Driver Installation severity medium T1048
Turla PNG Dropper Service severity critical T1543, T1543.003
Turla Service Install severity high T1543, T1543.003
Uncommon Service Installation Image Path severity medium T1543, T1543.003

Elastic (1)

Suspicious Service was Installed in the System severity medium T1543, T1543.003

Splunk (18)

Clop Ransomware Known Service Name severity medium T1543
Impacket SMBexec (Windows Event Log) T1021, T1021.006, T1059, T1569, T1569.002
Kernel Service Installed - Windows (Windows Event Log) T1068, T1543, T1543.003
Malicious Powershell Executed As A Service severity medium T1569, T1569.002
PSexec Service Creation (Windows Event Log) T1543, T1543.003, T1569, T1569.002
Randomly Generated Windows Service Name T1543, T1543.003
Service Created containing Command Shell (Windows Event Log) T1569, T1569.002
Service Installed (Windows Event Log) T1543, T1569
SimpleHelp Remote Access Tool Service Installation (Windows Event Log) T1219, T1543, T1569, T1569.002
Windows Bluetooth Service Installed From Uncommon Location severity low T1036, T1543, T1543.003
Windows Driver Load Non-Standard Path severity medium T1014, T1068
Windows KrbRelayUp Service Creation severity medium T1543, T1543.003
Windows Service Create RemComSvc severity low T1543, T1543.003
Windows Service Create SliverC2 severity medium T1569, T1569.002
Windows Service Created with Suspicious Service Name severity low T1569, T1569.002
Windows Service Created with Suspicious Service Path severity medium T1569, T1569.002
Windows Snake Malware Service Create severity medium T1547, T1547.006, T1569, T1569.002
Windows Vulnerable Driver Installed severity medium T1543, T1543.003

Kusto (1)

Credential Dumping Tools - Service Installation severity high T1003, T1003.001

YARA-L (1)

Suspicious Windows Service Installation Detected T1543, T1543.003

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Service-Control-Manager Event ID 7045

Sigma (55)

Elastic (1)

Splunk (18)

Kusto (1)

YARA-L (1)

Keyboard shortcuts

Search operators