Services

Service Installation Evidence #

Rules select service installation records, including driver registrations.

• Anydesk Remote Access Software Service Installation Sigma

  Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the software isn't already used.

• Clop Ransomware Known Service Name Splunk

  The following analytic identifies the creation of a service with a known name used by CLOP ransomware for persistence and high-privilege code execution. It detects this activity by monitoring Windows Event Logs (EventCode 7045) for specific service names ("SecurityCenterIBM", "WinCheckDRVs"). This activity is significant because the creation of such services is a common tactic used by ransomware to maintain control over infected systems. If confirmed malicious, this could allow attackers to execute code with elevated privileges, maintain persistence, and potentially disrupt or encrypt critical data.

• CobaltStrike Service Installations - System Sigma

  Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

• COLDSTEEL Persistence Service Creation Sigma

  Detects the creation of new services potentially related to COLDSTEEL RAT

• Credential Dumping Tools Service Execution - System Sigma

  Detects well-known credential dumping tools execution via service execution events

• CSExec Service Installation Sigma

  Detects CSExec service installation and execution events

• Goofy Guineapig Backdoor Service Creation Sigma

  Detects service creation persistence used by the Goofy Guineapig backdoor

• HackTool Service Registration or Execution Sigma

  Detects installation or execution of services

• Invoke-Obfuscation CLIP+ Launcher - System Sigma

  Detects Obfuscated use of Clip.exe to execute PowerShell

• Invoke-Obfuscation COMPRESS OBFUSCATION - System Sigma

  Detects Obfuscated Powershell via COMPRESS OBFUSCATION

• Invoke-Obfuscation RUNDLL LAUNCHER - System Sigma

  Detects Obfuscated Powershell via RUNDLL LAUNCHER

• Invoke-Obfuscation STDIN+ Launcher - System Sigma

  Detects Obfuscated use of stdin to execute PowerShell

• Invoke-Obfuscation VAR+ Launcher - System Sigma

  Detects Obfuscated use of Environment Variables to execute PowerShell

• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System Sigma

  Detects Obfuscated Powershell via VAR++ LAUNCHER

• Invoke-Obfuscation Via Stdin - System Sigma

  Detects Obfuscated Powershell via Stdin in Scripts

• Invoke-Obfuscation Via Use Clip - System Sigma

  Detects Obfuscated Powershell via use Clip.exe in Scripts

• Invoke-Obfuscation Via Use MSHTA - System Sigma

  Detects Obfuscated Powershell via use MSHTA in Scripts

• Invoke-Obfuscation Via Use Rundll32 - System Sigma

  Detects Obfuscated Powershell via use Rundll32 in Scripts

• Kernel Service Installed - Windows (Windows Event Log) Splunk

  Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD). Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via Ingress Tool Transfer or Lateral Tool Transfer. The use case detects Windows System Event ID 7045 with .sys file type.

• Malicious Powershell Executed As A Service Splunk

  The following analytic identifies the execution of malicious PowerShell commands or payloads via the Windows SC.exe utility. It detects this activity by analyzing Windows System logs (EventCode 7045) and filtering for specific PowerShell-related patterns in the ImagePath field. This behavior is significant because it indicates potential abuse of the Windows Service Control Manager to run unauthorized or harmful scripts, which could lead to system compromise. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.

• Mesh Agent Service Installation Sigma

  Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

• Meterpreter or Cobalt Strike Getsystem Service Installation - System Sigma

  Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

• Moriya Rootkit - System Sigma

  Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

• NetSupport Manager Service Install Sigma

  Detects NetSupport Manager service installation on the target system.

• New PDQDeploy Service - Client Side Sigma

  Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1

• New PDQDeploy Service - Server Side Sigma

  Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines

• OilRig APT Schedule Task Persistence - System Sigma

  Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

• PAExec Service Installation Sigma

  Detects PAExec service installation

• PowerShell Scripts Installed as Services Sigma

  Detects powershell script installed as a Service

• ProcessHacker Privilege Elevation Sigma

  Detects a ProcessHacker tool that elevated privileges to a very high level

• PSexec Service Creation (Windows Event Log) Splunk

  Detect creation of service for PSexec, as seen with Impackets PSexec.py or PSexec execution

• PsExec Service Installation Sigma

  Detects PsExec service installation and execution events

• Randomly Generated Windows Service Name Splunk

  The following analytic detects the installation of a Windows Service with a suspicious, high-entropy name, indicating potential malicious activity. It leverages Event ID 7045 and the `ut_shannon` function from the URL ToolBox Splunk application to identify services with random names. This behavior is significant as adversaries often use randomly named services for lateral movement and remote code execution. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.

• RemCom Service Installation Sigma

  Detects RemCom service installation and execution events

• Remote Access Tool Services Have Been Installed - System Sigma

  Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

• Remote Utilities Host Service Install Sigma

  Detects Remote Utilities Host service installation on the target system.

• RTCore Suspicious Service Installation Sigma

  Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver abuse

• Service Created containing Command Shell (Windows Event Log) Splunk

  This use case detects when a service has been created (event 7045) containing PowerShell or cmd commands

• Service Installation in Suspicious Folder Sigma

  Detects service installation in suspicious folder appdata

• Service Installation with Suspicious Folder Pattern Sigma

  Detects service installation with suspicious folder patterns

• Service Installed By Unusual Client - System Sigma

  Detects a service installed by a client which has PID 0 or whose parent has PID 0

• Sliver C2 Default Service Installation Sigma

  Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

• smbexec.py Service Installation Sigma

  Detects the use of smbexec.py tool by detecting a specific service installation

• SNAKE Malware Service Persistence Sigma

  Detects the creation of a service named "WerFaultSvc" which seems to be used by the SNAKE malware as a persistence mechanism as described by CISA in their report

• StoneDrill Service Install Sigma

  This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky

• Suspicious Service Installation Sigma

  Detects suspicious service installation commands

• Suspicious Service Installation Script Sigma

  Detects suspicious service installation scripts

• TacticalRMM Service Installation Sigma

  Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.

• Tap Driver Installation Sigma

  Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques

• Turla PNG Dropper Service Sigma

  This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018

• Turla Service Install Sigma

  This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET

• Uncommon Service Installation Image Path Sigma

  Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.

• Windows Bluetooth Service Installed From Uncommon Location Splunk

  Identifies the creation of a Windows service named "BluetoothService" with a binary path in user-writable directories, particularly %AppData%\Bluetooth. This technique was observed in the Lotus Blossom Chrysalis backdoor campaign, where attackers created a service named "BluetoothService" pointing to a malicious binary (renamed Bitdefender Submission Wizard) in a hidden AppData directory. While legitimate Bluetooth services exist in Windows, they are system services with binaries in System32. Any BluetoothService created with a binary path in user directories (AppData, Temp, Downloads) is highly suspicious and indicates potential malware persistence.

• Windows Driver Load Non-Standard Path Splunk

  The following analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. It identifies drivers not located in typical directories like Windows, Program Files, or SystemRoot. This activity is significant because adversaries may use these non-standard paths to load malicious or vulnerable drivers, potentially bypassing security controls. If confirmed malicious, this could allow attackers to execute code at the kernel level, escalate privileges, or maintain persistence within the environment, posing a severe threat to system integrity and security.

• Windows KrbRelayUp Service Creation Splunk

  The following analytic detects the creation of a service with the default name "KrbSCM" associated with the KrbRelayUp tool. It leverages Windows System Event Logs, specifically EventCode 7045, to identify this activity. This behavior is significant as KrbRelayUp is a known tool used for privilege escalation attacks. If confirmed malicious, this activity could allow an attacker to escalate privileges, potentially gaining unauthorized access to sensitive systems and data.

• Windows Service Create RemComSvc Splunk

  The following analytic detects the creation of the RemComSvc service on a Windows endpoint, typically indicating lateral movement using RemCom.exe. It leverages Windows EventCode 7045 from the System event log, specifically looking for the "RemCom Service" name. This activity is significant as it often signifies unauthorized lateral movement within the network, which is a common tactic used by attackers to spread malware or gain further access. If confirmed malicious, this could lead to unauthorized access to sensitive systems, data exfiltration, or further compromise of the network.

• Windows Service Create SliverC2 Splunk

  The following analytic detects the creation of a Windows service named "Sliver" with the description "Sliver Implant," indicative of SliverC2 lateral movement using the PsExec module. It leverages Windows EventCode 7045 from the System Event log to identify this activity. This behavior is significant as it may indicate an adversary's attempt to establish persistence or execute commands remotely. If confirmed malicious, this activity could allow attackers to maintain control over the compromised system, execute arbitrary code, and further infiltrate the network.

• Windows Service Created with Suspicious Service Name Splunk

  The following analytic detects the creation of a Windows Service with a known suspicious or malicious name using Windows Event ID 7045. It leverages logs from the `wineventlog_system` to identify these services installations. This activity is significant as adversaries, including those deploying Clop ransomware, often create malicious services for lateral movement, remote code execution, persistence, and execution. If confirmed malicious, this could allow attackers to maintain persistence, execute arbitrary code, and potentially escalate privileges, posing a severe threat to the environment.

• Windows Service Created with Suspicious Service Path Splunk

  The following analytic detects the creation of a Windows Service with a binary path located in uncommon directories, using Windows Event ID 7045. It leverages logs from the `wineventlog_system` to identify services installed outside typical system directories. This activity is significant as adversaries, including those deploying Clop ransomware, often create malicious services for lateral movement, remote code execution, persistence, and execution. If confirmed malicious, this could allow attackers to maintain persistence, execute arbitrary code, and potentially escalate privileges, posing a severe threat to the environment.

• Windows Snake Malware Service Create Splunk

  The following analytic detects the creation of a new service named WerFaultSvc with a binary path in the Windows WinSxS directory. It leverages Windows System logs, specifically EventCode 7045, to identify this activity. This behavior is significant because it indicates the presence of Snake malware, which uses this service to maintain persistence by blending in with legitimate Windows services. If confirmed malicious, this activity could allow an attacker to execute Snake malware components, leading to potential data exfiltration, system compromise, and long-term persistence within the environment.

• Windows Vulnerable Driver Installed Splunk

  The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Windows System service install EventCode 7045 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration. This detection is a Windows Event Log adaptation of the Sysmon driver loaded detection written by Michael Haag.

Service Registry Configuration #

Rules select registry changes to service paths, DLLs, and accounts.

• Service Binary in Suspicious Folder Sigma

  Detect the creation of a service with a service binary located in a suspicious directory

• Suspicious Service Installed Sigma

  Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)

Service Creation and Configuration Requests #

Rules select service creation and configuration commands.

• Abuse of Service Permissions to Hide Services Via Set-Service Sigma

  Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

• Abuse of Service Permissions to Hide Services Via Set-Service - PS Sigma

  Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

• EAP service activation by Liontail framework for DLL sideloading (via command) Sigma

  Detects scenarios where an attacker enable the Eaphost component in order to perform a DLL sideloading attack.

• New Kernel Driver Via SC.EXE Sigma

  Detects creation of a new service (kernel driver) with the type "kernel"

• New Service Creation Using PowerShell Sigma

  Detects the creation of a new service using powershell.

• New Service Creation Using Sc.EXE Sigma

  Detects the creation of a new service using the "sc.exe" utility.

• OpenSSH service activation on Windows Sigma

  Detects scenarios where an attacker enables the OpenSSH server on Windows to perform stealthy lateral movement.

• Service creation (PowerShell) Sigma

  Detects scenarios where an attacker attempts to create a service for persistence.

• Service permissions hijacked for privileges abuse (PowerShell) Sigma

  Detects scenarios where an attacker modify the permissions of a service using native PowerShell commands in order to abuse its privileges. Note that it requires PowerShell 7 or higher.

• Service StartupType Change Via PowerShell Set-Service Sigma

  Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"

• Suspicious New Service Creation Sigma

  Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

• Suspicious Service DACL Modification Via Set-Service Cmdlet Sigma

  Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable

• Suspicious Service DACL Modification Via Set-Service Cmdlet - PS Sigma

  Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

• Suspicious Service Path Modification Sigma

  Detects service path modification via the "sc" binary to a suspicious command or path

Service Control Requests #

Rules select service control and deletion commands.

• EAP service activation by Liontail framework for DLL sideloading (via command) Sigma

  Detects scenarios where an attacker enable the Eaphost component in order to perform a DLL sideloading attack.

Reported Service State and Startup Configuration #

Rules select reported service states, including running or stopped, and startup configuration changes such as disabled settings.

• Windows Defender Threat Detection Service Disabled Sigma

  Detects when the "Windows Defender Threat Protection" service is disabled.

Service Activity Sequences #

Rules correlate service connections, registry changes, and process activity.

No rules currently have sufficient source evidence for selection in this section.

Service Control Endpoint Access #

Security share access checks select the SVCCTL endpoint. They do not identify the service operation requested through that endpoint.

• CrackMaxpExec share permission enumeration Sigma

  Detects scenarios where an attacker would perform share permission enumeration using CrackMaxExec SMBmodule.

• Massive remote service creation via named pipes (TChopper, CME) Sigma

  Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.

• Massive remote service creation via named pipes - Tchopper Sigma

  Detects scenarios where an attacker uses the Tchopper tool by remotely creating multiple services via named pipes.

• Remote Service Activity via SVCCTL Named Pipe Sigma

  Detects remote service activity via remote access to the svcctl named pipe

• Remote service creation via named pipes Sigma

  Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.

Service and SCM Security Evidence #

Rules select permission commands and privileged SCM access.

No rules currently have sufficient source evidence for selection in this section.

Service Registry Permission Evidence #

Service registry permission changes and requests.

No rules currently have sufficient source evidence for selection in this section.

Service Discovery and Permission Inspection #

Service discovery and registry permission queries.

No rules currently have sufficient source evidence for selection in this section.