Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Suspicious Service Installation Script

Detects suspicious service installation scripts

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Martin MuellerCreated Fri Mar 18Updated Tue Mar 0570f00d10-60b2-4f34-b9a0-dc3df3fe762awindows
Log Source
Windowssystem
ProductWindows← raw: windows
Servicesystem← raw: system
Detection Logic
Detection Logic3 selectors
detection:
    selection_eid:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection_cmd_flags:
        ImagePath|contains|windash:
            - ' -c '
            - ' -r '
            - ' -k '
    selection_binaries:
        ImagePath|contains:
            - 'cscript'
            - 'mshta'
            - 'powershell'
            - 'pwsh'
            - 'regsvr32'
            - 'rundll32'
            - 'wscript'
    condition: all of selection_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
Internal Research
MITRE ATT&CK

CAR Analytics

2013-09-005 · CAR 2013-09-005
Rule Metadata
Rule ID
70f00d10-60b2-4f34-b9a0-dc3df3fe762a
Status
test
Level
high
Type
Detection
Created
Fri Mar 18
Modified
Tue Mar 05
Author
Martin Mueller
Path
rules/windows/builtin/system/service_control_manager/win_system_susp_service_installation_script.yml
Raw Tags
attack.persistenceattack.privilege-escalationcar.2013-09-005attack.t1543.003
View on GitHub