detection.wiki

Detection rules › Sigma

Impacket SMBexec service registration (native)

Status
experimental
Severity
high
Log source
product windows, service ['system', 'security']
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to register the SMBexec service to estasblish persistence. Note that service registration is not always performed and that is recommended to use the related registry SYSMON rule to increase detection reliability.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry, T1543.003 Create or Modify System Process: Windows Service
Privilege EscalationT1543.003 Create or Modify System Process: Windows Service
Defense ImpairmentT1112 Modify Registry

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4697A service was installed in the system.
Service-Control-ManagerEvent ID 7045Event ID 7045

Rule body yaml

title: Impacket SMBexec service registration (native)
description: Detects scenarios where an attacker attempts to register the SMBexec service to estasblish persistence. Note that service registration is not always performed and that is recommended to use the related registry SYSMON rule to increase detection reliability.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1543.003-Create%20or%20Modify%20System%20Process-Windows%20Service
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py
- https://nv2lt.github.io/windows/smb-psexec-smbexec-winexe-how-to/
tags:
- attack.defense_evasion
- attack.t1112
- attack.privilege_execution
- attack.t1543.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: 
    - system
    - security
detection:
  selection:
    EventID:
      - 4697
      - 7045
    ServiceName: BTOBTO # Service name can be changed in the application name
  filter:
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID:
    - 4697
    - 7045
  ServiceName: BTOBTO

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ServiceNameeq
  • BTOBTO corpus 2 (sigma 2)