PowerShell Creates Windows Service via New-Service and -BinaryPathName

Flags PowerShell command lines that use New-Service with -BinaryPathName to create a Windows service.

FreeUnreviewedSigmalowv1

powershell-creates-windows-service-via-new-service-and-binarypathname-c02e96b7

title: PowerShell Creates Windows Service via New-Service and -BinaryPathName
id: 4d46753e-cb45-4f6a-9b67-f94589f472c3
related:
  - id: 85ff530b-261d-48c6-a441-facaa2e81e48
    type: similar
  - id: c02e96b7-c63a-4c47-bd83-4a9f74afcfb2
    type: derived
status: test
description: This rule identifies Windows process executions where the command line contains both "New-Service" and "-BinaryPathName" in PowerShell. Creating services from PowerShell can establish persistence or run attacker-controlled payloads with elevated or scheduled execution. The detection relies on process creation telemetry and inspects the full command line for these specific parameters.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_create_service.yml
author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2023-02-20
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - New-Service
      - -BinaryPathName
  condition: selection
falsepositives:
  - Legitimate administrator or user creates a service for legitimate reasons.
  - Software installation
level: low
license: DRL-1.1

What it detects

This rule identifies Windows process executions where the command line contains both "New-Service" and "-BinaryPathName" in PowerShell. Creating services from PowerShell can establish persistence or run attacker-controlled payloads with elevated or scheduled execution. The detection relies on process creation telemetry and inspects the full command line for these specific parameters.

Known false positives

Legitimate administrator or user creates a service for legitimate reasons.
Software installation

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.