Windows Service Control Manager: Detect PAExec- service installation
Flags creation of PAExec-named Windows services with image paths under C:\WINDOWS via Event ID 7045.
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-26
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies creation of a Windows service via Service Control Manager where the service name begins with "PAExec-" and the configured image path starts with "C:\WINDOWS\PAExec-". Attackers can use service installation to run code with elevated privileges and persist access on the host. It relies on Windows System logs for Service Control Manager event ID 7045 and matches the service provider name, service name prefix, and image path prefix.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Service Control Manager: Detect PAExec- service installation"
id: 97d6e97a-e12e-4f2e-8035-8c740c20d78b
status: test
description: This rule identifies creation of a Windows service via Service Control Manager where the service name begins with "PAExec-" and the configured image path starts with "C:\WINDOWS\PAExec-". Attackers can use service installation to run code with elevated privileges and persist access on the host. It relies on Windows System logs for Service Control Manager event ID 7045 and matches the service provider name, service name prefix, and image path prefix.
references:
- https://www.poweradmin.com/paexec/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_paexec.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-26
tags:
- attack.execution
- attack.t1569.002
logsource:
product: windows
service: system
detection:
selection_eid:
Provider_Name: Service Control Manager
EventID: 7045
selection_image:
- ServiceName|startswith: PAExec-
- ImagePath|startswith: C:\WINDOWS\PAExec-
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: de7ce410-b3fb-4e8a-b38c-3b999e2c3420
type: derived