Windows: PowerShell script executed via Service Control Manager (Event ID 7045)

title: "Windows: PowerShell script executed via Service Control Manager (Event ID 7045)"
id: e43d1654-ed24-40ae-a89d-8d633fe84294
status: test
description: This rule identifies Windows services being created or started where the Service Control Manager reports Event ID 7045 and the configured ImagePath contains PowerShell binaries (powershell or pwsh). Attackers can use this technique to persist or run script-based payloads through the Windows service mechanism. The detection relies on Windows System service telemetry, specifically Event ID 7045 and the service ImagePath field reported by the Service Control Manager.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_powershell_script_installed_as_service.yml
author: oscd.community, Natalia Shornikova, Huntrule Team
date: 2020-10-06
modified: 2022-12-25
tags:
  - attack.execution
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains:
      - powershell
      - pwsh
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a2e5019d-a658-4c6a-92bf-7197b54e2cae
    type: derived