Impacket SMBexec service registration (native)

Status: experimental
Severity: high
Log source: product windows, service ['system', 'security']
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to register the SMBexec service to estasblish persistence. Note that service registration is not always performed and that is recommended to use the related registry SYSMON rule to increase detection reliability.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry `T1543.003` Create or Modify System Process: Windows Service
Privilege Escalation	`T1543.003` Create or Modify System Process: Windows Service
Defense Impairment	`T1112` Modify Registry

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4697: A service was installed in the system.
Service-Control-Manager	Event ID 7045: A service was installed in the system.

Rule body

title: Impacket SMBexec service registration (native)
description: Detects scenarios where an attacker attempts to register the SMBexec service to estasblish persistence. Note that service registration is not always performed and that is recommended to use the related registry SYSMON rule to increase detection reliability.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1543.003-Create%20or%20Modify%20System%20Process-Windows%20Service
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py
- https://nv2lt.github.io/windows/smb-psexec-smbexec-winexe-how-to/
tags:
- attack.defense_evasion
- attack.t1112
- attack.privilege_execution
- attack.t1543.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: 
    - system
    - security
detection:
  selection:
    EventID:
      - 4697
      - 7045
    ServiceName: BTOBTO # Service name can be changed in the application name
  filter:
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID:
    - 4697
    - 7045
  ServiceName: BTOBTO

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ServiceName`	eq	`BTOBTO` corpus 2 (sigma 2)	`field:"ServiceName" kind:eq value:"BTOBTO"`