Suspicious Remote Utilities Host Service Install (via system)

title: Suspicious Remote Utilities Host Service Install (via system)
id: 35f2964d-cb99-5632-85ff-32c85b3523ae
status: stable
description: This rule detects Remote Utilities Host service installation on the target system.
references:
    - https://www.remoteutilities.com/support/kb/host-service-won-t-start/
author: Huntrule Team
date: 2026-07-13
tags:
    - attack.persistence
    - attack.command-and-control
    - attack.t1219
    - attack.t1543.003
logsource:
    product: windows
    service: system
detection:
    selection_root:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection_service:
        - ImagePath|contains|all:
              - '\rutserv.exe'
              - '-service'
        - ServiceName: 'Remote Utilities - Host'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium