win:system 7045
New Windows Service
- Log source
- Windows System event log
- Host type
- Windows (workstation, member server, domain controller)
- Tier, host type
- Minimum
- Techniques
- 12
- Rules depending on it
- Splunk 12, Sigma 48, Elastic 1, Microsoft Sentinel 1
Why this tier
NSA
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | NSA |
| Windows member server | Minimum | NSA |
| Windows domain controller | Minimum | NSA |
| Windows web server (IIS), internet-facing | Minimum | NSA |
Techniques it helps detect
- T1014 Rootkit
- T1036 Masquerading
- T1036.004 Masquerade Task or Service
- T1040 Network Sniffing
- T1056.001 Keylogging
- T1195.003 Compromise Hardware Supply Chain
- T1205.002 Socket Filters
- T1219 Remote Access Tools
- T1563.002 RDP Hijacking
- T1564.006 Run Virtual Instance
- T1574.010 Services File Permissions Weakness
- T1685 Disable or Modify Tools
Rules that depend on it
Splunk 12
- Clop Ransomware Known Service Name
- Malicious Powershell Executed As A Service
- Randomly Generated Windows Service Name
- Windows Bluetooth Service Installed From Uncommon Location
- Windows Driver Load Non-Standard Path
- Windows KrbRelayUp Service Creation
- Windows Service Create RemComSvc
- Windows Service Create SliverC2
- Windows Service Created with Suspicious Service Name
- Windows Service Created with Suspicious Service Path
- Windows Snake Malware Service Create
- Windows Vulnerable Driver Installed
Sigma 48
- Anydesk Remote Access Software Service Installation by Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
- COLDSTEEL Persistence Service Creation by Nasreddine Bencherchali (Nextron Systems)
- CSExec Service Installation by Nasreddine Bencherchali (Nextron Systems)
- CobaltStrike Service Installations - System by Florian Roth (Nextron Systems), Wojciech Lesicki
- Credential Dumping Tools Service Execution - System by Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
- Goofy Guineapig Backdoor Service Creation by Nasreddine Bencherchali (Nextron Systems)
- HackTool Service Registration or Execution by Florian Roth (Nextron Systems)
- Invoke-Obfuscation CLIP+ Launcher - System by Jonathan Cheong, oscd.community
- Invoke-Obfuscation COMPRESS OBFUSCATION - System by Timur Zinniatullin, oscd.community
- Invoke-Obfuscation Obfuscated IEX Invocation - System by Daniel Bohannon (@Mandiant/@FireEye), oscd.community
- Invoke-Obfuscation RUNDLL LAUNCHER - System by Timur Zinniatullin, oscd.community
- Invoke-Obfuscation STDIN+ Launcher - System by Jonathan Cheong, oscd.community
- Invoke-Obfuscation VAR+ Launcher - System by Jonathan Cheong, oscd.community
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System by Timur Zinniatullin, oscd.community
- Invoke-Obfuscation Via Stdin - System by Nikita Nazarov, oscd.community
- Invoke-Obfuscation Via Use Clip - System by Nikita Nazarov, oscd.community
- Invoke-Obfuscation Via Use MSHTA - System by Nikita Nazarov, oscd.community
- Invoke-Obfuscation Via Use Rundll32 - System by Nikita Nazarov, oscd.community
- KrbRelayUp Service Installation by Sittikorn S, Tim Shelton
- Mesh Agent Service Installation by Nasreddine Bencherchali (Nextron Systems)
- Meterpreter or Cobalt Strike Getsystem Service Installation - System by Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)
- Moriya Rootkit - System by Bhabesh Raj
- NetSupport Manager Service Install by Nasreddine Bencherchali (Nextron Systems)
- New PDQDeploy Service - Client Side by Nasreddine Bencherchali (Nextron Systems)
- New PDQDeploy Service - Server Side by Nasreddine Bencherchali (Nextron Systems)
- OilRig APT Schedule Task Persistence - System by Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
- PAExec Service Installation by Nasreddine Bencherchali (Nextron Systems)
- PowerShell Scripts Installed as Services by oscd.community, Natalia Shornikova
- ProcessHacker Privilege Elevation by Florian Roth (Nextron Systems)
- PsExec Service Installation by Thomas Patzke
- RTCore Suspicious Service Installation by Nasreddine Bencherchali (Nextron Systems)
- RemCom Service Installation by Nasreddine Bencherchali (Nextron Systems)
- Remote Access Tool Services Have Been Installed - System by Connor Martin, Nasreddine Bencherchali
- Remote Utilities Host Service Install by Nasreddine Bencherchali (Nextron Systems)
- SNAKE Malware Service Persistence by Nasreddine Bencherchali (Nextron Systems)
- Service Installation in Suspicious Folder by pH-T (Nextron Systems)
- Service Installation with Suspicious Folder Pattern by pH-T (Nextron Systems)
- Service Installed By Unusual Client - System by Tim Rauch (Nextron Systems), Elastic (idea)
- Sliver C2 Default Service Installation by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- StoneDrill Service Install by Florian Roth (Nextron Systems)
- Suspicious Service Installation by pH-T (Nextron Systems), Florian Roth (Nextron Systems)
- Suspicious Service Installation Script by pH-T (Nextron Systems)
- TacticalRMM Service Installation by Nasreddine Bencherchali (Nextron Systems)
- Tap Driver Installation by Daniil Yugoslavskiy, Ian Davis, oscd.community
- Turla PNG Dropper Service by Florian Roth (Nextron Systems)
- Turla Service Install by Florian Roth (Nextron Systems)
- Uncommon Service Installation Image Path by Florian Roth (Nextron Systems)
- smbexec.py Service Installation by Omer Faruk Celik
Microsoft Sentinel 1
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Infrastructure changesAppendix B item 5(5) | Supports an activity | our analysis: service installed |
| OMB M-26-14: Attack vectors and lateral movementAppendix B item 5(10) | Supports an activity | our analysis: remote service installation (PsExec style) |
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | Software and Service Installation: New Windows Service |
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| Microsoft Defender for Endpoint device tables | DeviceEvents | Partial | our analysis: ServiceInstalled ActionType in DeviceEvents |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | ServiceStarted | Partial | our analysis: ServiceStarted in the FDR feed reports service start, not installation |