Detectionhightest

Service Binary in Suspicious Folder

Detect the creation of a service with a service binary located in a suspicious directory

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems), François HubautCreated Mon May 02Updated Tue Oct 07a07f0359-4c90-4dc4-a681-8ffea40b4f47windows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection_service_start:
        TargetObject|startswith: 'HKLM\System\CurrentControlSet\Services\'
        TargetObject|endswith: '\Start'
        Image|contains:
            - '\Users\Public\'
            - '\Perflogs\'
            - '\ADMIN$\'
            - '\Temp\'
        Details:
            - 'DWORD (0x00000000)'  # boot
            - 'DWORD (0x00000001)'  # System
            - 'DWORD (0x00000002)'  # Automatic
            # 3 - Manual , 4 - Disabled
    selection_service_imagepath:
        TargetObject|startswith: 'HKLM\System\CurrentControlSet\Services\'
        TargetObject|endswith: '\ImagePath'
        Details|contains:
            - '\Users\Public\'
            - '\Perflogs\'
            - '\ADMIN$\'
            - '\Temp\'
    filter_optional_avast:
        Image|contains|all: # Filter FP with Avast software
            - '\Common Files\'
            - '\Temp\'
    filter_optional_mbamservice:
        TargetObject|endswith: '\CurrentControlSet\Services\MBAMInstallerService\ImagePath'
        Details|endswith: '\AppData\Local\Temp\MBAMInstallerService.exe"'
        Image: 'C:\Windows\system32\services.exe'
    condition: 1 of selection_* and not 1 of filter_optional_*