Detectionhightest

Service Installed By Unusual Client - System

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Tim Rauch, Elastic SecurityCreated Thu Sep 15Updated Wed Jan 0471c276aa-49cd-43d2-b920-2dcd3e6962d5windows

Log Source

Windowssystem

ProductWindows← raw: windows

Servicesystem← raw: system

Detection Logic

detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        ProcessId: 0
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Techniques

Related Rules

Service Installed By Unusual Client - Security

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

71c276aa-49cd-43d2-b920-2dcd3e6962d5

Status

test

Level

high

Type

Detection

Created

Thu Sep 15

Modified

Wed Jan 04

Author

Path

rules/windows/builtin/system/service_control_manager/win_system_service_install_sups_unusal_client.yml

Raw Tags

attack.persistenceattack.privilege-escalationattack.t1543