Detection rules › Splunk
Service Installed (Windows Event Log)
Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. This use case looks for when a service installed event code has triggered. Adversaries can also use native tools such as wce.exe or even psexec.exe to install a service. - Eventcode 4697 The minimum OS version is Server 2016 or Windows 10. Eventcode 7045 Windows Server 2008 R2 and 7, Windows Server 2012 R2 and 8.1, Windows Server 2016 and 10
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Persistence | |
| Privilege Escalation |
References
Telemetry coverage
Rule body
id: '6101.6560'
title: Service Installed
description: 'Adversaries may abuse the Windows service control manager to execute
malicious commands or payloads. This use case looks for when a service installed
event code has triggered. Adversaries can also use native tools such as wce.exe
or even psexec.exe to install a service. - Eventcode 4697 The minimum OS version
is Server 2016 or Windows 10. Eventcode 7045 Windows Server 2008 R2 and 7, Windows
Server 2012 R2 and 8.1, Windows Server 2016 and 10 - Threat Actor Association: Akira,
Alloy Taurus/Gallium, APT29/Nobelium/Cozy Bear, APT43, Earth Estries, Lancefly,
Lazarus, Redfly - Software Association: Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4697) OR
"<EventID>4697<" OR TERM(EventCode=7045) OR "<EventID>7045<") |eval service_name=Service_Name,
service_path=Service_File_Name, service_id=Service_Account | table _time, host,
user, signature_id, service_* | bin span=1s | stats values(*) as * by _time, host
| eventstats dc(service_name) as dc_service by service_name | where dc_service <
6 '
techniques:
- execution:system services
- persistence:create or modify system process
technique_id:
- T1569
- T1543
data_category:
- Windows event logs
references:
- https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4697) OR "<EventID>4697<" OR TERM(EventCode=7045) OR "<EventID>7045<")
Stage 2: eval
| eval service_name=Service_Name, service_path=Service_File_Name, service_id=Service_Account
Stage 3: table
| table _time, host, user, signature_id, service_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Stage 6: eventstats
| eventstats dc(service_name) as dc_service by service_name
Stage 7: where
| where dc_service < 6
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq |
dc_service | lt |
| field:"dc_service" kind:lt value:"6" |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4697<" |
| 1 | "<EventID>7045<" |