Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Service Installation in Suspicious Folder

Detects service installation in suspicious folder appdata

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Martin MuellerCreated Fri Mar 18Updated Thu Jan 185e993621-67d4-488a-b9ae-b420d08b96cbwindows
Log Source
Windowssystem
ProductWindows← raw: windows
Servicesystem← raw: system
Detection Logic
Detection Logic2 selectors
detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        ImagePath|contains:
            - '\AppData\'
            - '\\\\127.0.0.1'
            - '\\\\localhost'
    filter_optional_zoom:
        ServiceName: 'Zoom Sharing Service'
        ImagePath|contains: ':\Program Files\Common Files\Zoom\Support\CptService.exe'
    condition: selection and not 1 of filter_optional_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
Internal Research
MITRE ATT&CK

CAR Analytics

2013-09-005 · CAR 2013-09-005
Rule Metadata
Rule ID
5e993621-67d4-488a-b9ae-b420d08b96cb
Status
test
Level
medium
Type
Detection
Created
Fri Mar 18
Modified
Thu Jan 18
Author
Martin Mueller
Path
rules/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder.yml
Raw Tags
attack.persistenceattack.privilege-escalationcar.2013-09-005attack.t1543.003
View on GitHub