Detection rules › Splunk

Windows Service Started (Windows Event Log)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads

MITRE ATT&CK coverage

Telemetry coverage

Rule body

id: '5703.5964'
title: Windows Service Started
description: 'Adversaries may abuse the Windows service control manager to execute
  malicious commands or payloads. - Threat Actor Association: APT28 (aka.Fancy Bear,
  Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29/Nobelium/Cozy
  Bear, Blackbyte, Carbanak, Earth Estries, Magic Hound (aka APT35, Charming Kitten,
  Phosphorus, and Mint Sandstorm) - Software Association: Ryuk, Snatch, WannaCry -
  Atomics T1569.002 Test#1 Atomics T1543.003 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") (TERM(sc) OR TERM(sc.exe) OR TERM(net) OR TERM(net.exe) OR TERM(net1.exe))
  TERM(start) |regex process="(?i)start\s"| table _time, host, user, signature_id,
  process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:system services:service execution
technique_id:
- T1569.002
data_category:
- Process command-line parameters
- Windows event logs
references: null

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<") (TERM(sc) OR TERM(sc.exe) OR TERM(net) OR TERM(net.exe) OR TERM(net1.exe)) TERM(start)

Stage 2: regex

| regex process="(?i)start\s"

Stage 3: table

| table _time, host, user, signature_id, process, process_*, parent_*

Stage 4: bucket

| bin span=1s

Stage 5: stats

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventCodeeq
  • 4688 corpus 317 (splunk 283, kusto 33, elastic 1)
field:"EventID" kind:eq value:"4688"
processregex_match
  • "(?i)start\s"
field:"CommandLine" kind:regex_match

Search terms

These SPL tokens match against raw event text.

StageTerm
1"<EventID>4688<"
1sc
1sc.exe
1net
1net.exe
1net1.exe
1start