Detection rules › Splunk
Service Installed (Windows Event Log)
Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. This use case looks for when a service installed event code has triggered. Adversaries can also use native tools such as wce.exe or even psexec.exe to install a service. - Eventcode 4697 The minimum OS version is Server 2016 or Windows 10. Eventcode 7045 Windows Server 2008 R2 and 7, Windows Server 2012 R2 and 8.1, Windows Server 2016 and 10
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1569 System Services |
| Persistence | T1543 Create or Modify System Process |
| Privilege Escalation | T1543 Create or Modify System Process |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4697 | A service was installed in the system. |
| Service-Control-Manager | Event ID 7045 | Event ID 7045 |
Rule body yaml
id: '6101.6560'
title: Service Installed
description: 'Adversaries may abuse the Windows service control manager to execute
malicious commands or payloads. This use case looks for when a service installed
event code has triggered. Adversaries can also use native tools such as wce.exe
or even psexec.exe to install a service. - Eventcode 4697 The minimum OS version
is Server 2016 or Windows 10. Eventcode 7045 Windows Server 2008 R2 and 7, Windows
Server 2012 R2 and 8.1, Windows Server 2016 and 10 - Threat Actor Association: Akira,
Alloy Taurus/Gallium, APT29/Nobelium/Cozy Bear, APT43, Earth Estries, Lancefly,
Lazarus, Redfly - Software Association: Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4697) OR
"<EventID>4697<" OR TERM(EventCode=7045) OR "<EventID>7045<") |eval service_name=Service_Name,
service_path=Service_File_Name, service_id=Service_Account | table _time, host,
user, signature_id, service_* | bin span=1s | stats values(*) as * by _time, host
| eventstats dc(service_name) as dc_service by service_name | where dc_service <
6 '
techniques:
- execution:system services
- persistence:create or modify system process
technique_id:
- T1569
- T1543
data_category:
- Windows event logs
references:
- https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4697) OR "<EventID>4697<" OR TERM(EventCode=7045) OR "<EventID>7045<")
Stage 2: eval
| eval service_name=Service_Name, service_path=Service_File_Name, service_id=Service_Account
Stage 3: table
| table _time, host, user, signature_id, service_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Stage 6: eventstats
| eventstats dc(service_name) as dc_service by service_name
Stage 7: where
| where dc_service < 6
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
dc_service | lt |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4697<" |
| 1 | TERM |
| 1 | "<EventID>7045<" |