Detection rules › Sigma
StoneDrill Service Install
This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1543.003 Create or Modify System Process: Windows Service |
| Privilege Escalation | T1543.003 Create or Modify System Process: Windows Service |
Event coverage
| Provider | Event |
|---|---|
| Service-Control-Manager | Event ID 7045 |
Rule body yaml
title: StoneDrill Service Install
id: 9e987c6c-4c1e-40d8-bd85-dd26fba8fdd6
status: test
description: This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky
references:
- https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/
author: Florian Roth (Nextron Systems)
date: 2017-03-07
modified: 2021-11-30
tags:
- attack.privilege-escalation
- attack.persistence
- attack.g0064
- attack.t1543.003
- detection.emerging-threats
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: 'Service Control Manager'
EventID: 7045
ServiceName: NtsSrv
ImagePath|endswith: ' LocalService'
condition: selection
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Provider_Name: 'Service Control Manager'
EventID: 7045
ServiceName: NtsSrv
ImagePath|endswith: ' LocalService'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ImagePath | ends_with |
|
Provider_Name | eq |
|
ServiceName | eq |
|