Detection rules › Sigma
Suspicious Service Installation Script
Detects suspicious service installation scripts
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1543.003 Create or Modify System Process: Windows Service |
| Privilege Escalation | T1543.003 Create or Modify System Process: Windows Service |
Event coverage
| Provider | Event |
|---|---|
| Service-Control-Manager | Event ID 7045 |
Rule body yaml
title: Suspicious Service Installation Script
id: 70f00d10-60b2-4f34-b9a0-dc3df3fe762a
status: test
description: Detects suspicious service installation scripts
references:
- Internal Research
author: pH-T (Nextron Systems)
date: 2022-03-18
modified: 2024-03-05
tags:
- attack.persistence
- attack.privilege-escalation
- car.2013-09-005
- attack.t1543.003
logsource:
product: windows
service: system
detection:
selection_eid:
Provider_Name: 'Service Control Manager'
EventID: 7045
selection_cmd_flags:
ImagePath|contains|windash:
- ' -c '
- ' -r '
- ' -k '
selection_binaries:
ImagePath|contains:
- 'cscript'
- 'mshta'
- 'powershell'
- 'pwsh'
- 'regsvr32'
- 'rundll32'
- 'wscript'
condition: all of selection_*
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_eid
selection_eid:
Provider_Name: 'Service Control Manager'
EventID: 7045
Stage 2: selection_cmd_flags
selection_cmd_flags:
ImagePath|contains|windash:
- ' -c '
- ' -r '
- ' -k '
Stage 3: selection_binaries
selection_binaries:
ImagePath|contains:
- 'cscript'
- 'mshta'
- 'powershell'
- 'pwsh'
- 'regsvr32'
- 'rundll32'
- 'wscript'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ImagePath | match |
|
Provider_Name | eq |
|