Windows: Detects PAExec- service installation via Service Control Manager (Event ID 7045)

title: "Windows: Detects PAExec- service installation via Service Control Manager (Event ID 7045)"
id: 97d6e97a-e12e-4f2e-8035-8c740c20d78b
status: test
description: This rule identifies Windows service creation events where the Service Control Manager reports Event ID 7045 for a service name beginning with "PAExec-" and an executable image path starting with "C:\WINDOWS\PAExec-". Attackers may use PAExec-style services to run commands or payloads with elevated privileges, making service installation telemetry a high-signal indicator. It relies on Windows System logs capturing Service Control Manager service installation metadata, including the provider, service name, and image path.
references:
  - https://www.poweradmin.com/paexec/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_paexec.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-26
tags:
  - attack.execution
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection_eid:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_image:
    - ServiceName|startswith: PAExec-
    - ImagePath|startswith: C:\WINDOWS\PAExec-
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: de7ce410-b3fb-4e8a-b38c-3b999e2c3420
    type: derived