Detection rules › Splunk
Windows Service Created (Windows Event Log)
Adversaries may leverage sc.exe to execute malicious content by creating a new service
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Persistence | |
| Privilege Escalation |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
id: '5705.5974'
title: Windows Service Created
description: 'Adversaries may leverage sc.exe to execute malicious content by creating
a new service. -- Threat Actor Association: Alloy Taurus/Gallium, APT27/Emissary
Panda, APT29/Nobelium/Cozy Bear, Earth Estries, FamousSparrow, FIN6, FIN7, FIN12,
Flax Typhoon, GoldenJackal, Lazarus, Magic Hound (aka APT35, Charming Kitten, Phosphorus,
and Mint Sandstorm), MalKamak, Memento Team, Night Spider, Prophet Spider, Redfly,
Wizard Spider - Software Association: Bazar, Conti, Clop, Cuba, DirtyMoe, GhostShell,
Hancitor, Midas, Prometheus/Spook, Snatch -- Atomics T1036.004 Test #2 Atomics T1574.009
Test#1 -- #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process OR TERM(ingress.event.procstart)) (TERM(sc) OR
TERM(sc.exe)) TERM(create) |regex process="(?i)sc(\.exe)?\s(.+)?create\s"| table
_time, host, user, signature_id, process, process_*, parent_* | bin span=1s | stats
values(*) as * by _time, host '
techniques:
- execution:system services:service execution
- persistence:create or modify system process
technique_id:
- T1569.002
- T1543
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
- https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process OR TERM(ingress.event.procstart)) (TERM(sc) OR TERM(sc.exe)) TERM(create)
Stage 2: regex
| regex process="(?i)sc(\.exe)?\s(.+)?create\s"
Stage 3: table
| table _time, host, user, signature_id, process, process_*, parent_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4688" |
process | regex_match |
| field:"CommandLine" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4688<" |
| 1 | ingress.event.procstart |
| 1 | sc |
| 1 | sc.exe |
| 1 | create |