Detection rules › Sigma
Service Installation with Suspicious Folder Pattern
Detects service installation with suspicious folder patterns
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Privilege Escalation |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Service-Control-Manager | Event ID 7045: A service was installed in the system. |
Rule body
title: Service Installation with Suspicious Folder Pattern
id: 1b2ae822-6fe1-43ba-aa7c-d1a3b3d1d5f2
status: test
description: Detects service installation with suspicious folder patterns
references:
- Internal Research
author: pH-T (Nextron Systems)
date: 2022-03-18
modified: 2022-03-24
tags:
- attack.persistence
- attack.privilege-escalation
- car.2013-09-005
- attack.t1543.003
logsource:
product: windows
service: system
detection:
selection_eid:
Provider_Name: 'Service Control Manager'
EventID: 7045
selection_img_paths:
- ImagePath|re: '^[Cc]:\\[Pp]rogram[Dd]ata\\.{1,9}\.exe'
- ImagePath|re: '^[Cc]:\\.{1,9}\.exe'
condition: all of selection_*
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_eid
selection_eid:
Provider_Name: 'Service Control Manager'
EventID: 7045
Stage 2: selection_img_paths
selection_img_paths:
- ImagePath|re: '^[Cc]:\\[Pp]rogram[Dd]ata\\.{1,9}\.exe'
- ImagePath|re: '^[Cc]:\\.{1,9}\.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ImagePath | regex_match |
| field:"ImagePath" kind:regex_match |
Provider_Name | eq |
| field:"Provider_Name" kind:eq value:"Service Control Manager" |