Remote Utilities Host Service Install

Status: test
Severity: medium
Log source: product windows, service system
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects Remote Utilities Host service installation on the target system.

Known false positives

Legitimate use of the tool

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	No specific technique

Telemetry coverage

Provider	Record / event type
Service-Control-Manager	Event ID 7045: A service was installed in the system.

Rule body

title: Remote Utilities Host Service Install
id: 85cce894-dd8b-4427-a958-5cc47a4dc9b9
status: test
description: Detects Remote Utilities Host service installation on the target system.
references:
    - https://www.remoteutilities.com/support/kb/host-service-won-t-start/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-31
tags:
    - attack.persistence
logsource:
    product: windows
    service: system
detection:
    # Example:
    #   <EventData>
    #       <Data Name="ServiceName">Remote Utilities - Host</Data>
    #       <Data Name="ImagePath">"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service</Data>
    #       <Data Name="ServiceType">user mode service</Data>
    #       <Data Name="StartType">auto start</Data>
    #       <Data Name="AccountName">LocalSystem</Data>
    #   </EventData>
    selection_root:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection_service:
        - ImagePath|contains|all:
              - '\rutserv.exe'
              - '-service'
        - ServiceName: 'Remote Utilities - Host'
    condition: all of selection_*
falsepositives:
    - Legitimate use of the tool
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_root`

selection_root:
    Provider_Name: 'Service Control Manager'
    EventID: 7045

Stage 2: `selection_service`

selection_service:
    - ImagePath|contains|all:
          - '\rutserv.exe'
          - '-service'
    - ServiceName: 'Remote Utilities - Host'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ImagePath`	match	`-service` `\rutserv.exe`	`field:"ImagePath" kind:match`
`Provider_Name`	eq	`Service Control Manager` corpus 50 (sigma 50)	`field:"Provider_Name" kind:eq value:"Service Control Manager"`
`ServiceName`	eq	`Remote Utilities - Host`	`field:"ServiceName" kind:eq value:"Remote Utilities - Host"`

Remote Utilities Host Service Install

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_root

Stage 2: selection_service

Indicators

Stage 0: `condition`

Stage 1: `selection_root`

Stage 2: `selection_service`