HackTool Service Registration or Execution

Status: test
Severity: high
Log source: product windows, service system
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects installation or execution of services

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1569.002` System Services: Service Execution

Telemetry coverage

Provider	Record / event type
Service-Control-Manager	Event ID 7036: The Microsoft Software Shadow Copy Provider service entered the stopped state.
Service-Control-Manager	Event ID 7045: A service was installed in the system.

Rule body

title: HackTool Service Registration or Execution
id: d26ce60c-2151-403c-9a42-49420d87b5e4
status: test
description: Detects installation or execution of services
references:
    - Internal Research
author: Florian Roth (Nextron Systems)
date: 2022-03-21
modified: 2023-08-07
tags:
    - attack.execution
    - attack.t1569.002
    - attack.s0029
logsource:
    product: windows
    service: system
detection:
    selection_eid:
        Provider_Name: 'Service Control Manager'
        EventID:
            - 7045
            - 7036
    selection_service_name:
        ServiceName|contains:
            - 'cachedump'
            - 'DumpSvc'
            - 'gsecdump'
            - 'pwdump'
            - 'UACBypassedService'
            - 'WCE SERVICE'
            - 'WCESERVICE'
            - 'winexesvc'
    selection_service_image:
        ImagePath|contains: 'bypass' # https://gist.github.com/tyranid/c24cfd1bd141d14d4925043ee7e03c82#file-scmuacbypass-cpp-L159
    condition: selection_eid and 1 of selection_service_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection_eid and 1 of selection_service_*

Stage 1: `selection_eid`

selection_eid:
    Provider_Name: 'Service Control Manager'
    EventID:
        - 7045
        - 7036

Stage 2: `selection_service_name`

selection_service_name:
    ServiceName|contains:
        - 'cachedump'
        - 'DumpSvc'
        - 'gsecdump'
        - 'pwdump'
        - 'UACBypassedService'
        - 'WCE SERVICE'
        - 'WCESERVICE'
        - 'winexesvc'

Stage 3: `selection_service_image`

selection_service_image:
    ImagePath|contains: 'bypass'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ImagePath`	match	`bypass`	`field:"ImagePath" kind:match value:"bypass"`
`Provider_Name`	eq	`Service Control Manager` corpus 50 (sigma 50)	`field:"Provider_Name" kind:eq value:"Service Control Manager"`
`ServiceName`	match	`DumpSvc` `UACBypassedService` `WCE SERVICE` `WCESERVICE` corpus 2 (sigma 1, kusto 1) `cachedump` corpus 2 (sigma 1, kusto 1) `gsecdump` `pwdump` corpus 2 (sigma 1, kusto 1) `winexesvc`	`field:"ServiceName" kind:match`

HackTool Service Registration or Execution

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_eid

Stage 2: selection_service_name

Stage 3: selection_service_image

Indicators

Stage 0: `condition`

Stage 1: `selection_eid`

Stage 2: `selection_service_name`

Stage 3: `selection_service_image`