huntrule

Windows Registry: Service configured with image path in suspicious public/temp folders

Detects Windows service ImagePath pointing to Users\Public, Perflogs, ADMIN$, or Temp based on registry_set events.

FreeUnreviewedSigmahighv1
title: "Windows Registry: Service configured with image path in suspicious public/temp folders"
id: e2f2523a-ee51-4d5a-bd20-d2e6fea929d0
related:
  - id: c0abc838-36b0-47c9-b3b3-a90c39455382
    type: obsolete
  - id: a07f0359-4c90-4dc4-a681-8ffea40b4f47
    type: derived
status: test
description: This rule flags creation or modification of a Windows service where the service’s registry values indicate an ImagePath located in commonly abused folders such as Users\Public, Perflogs, ADMIN$, or Temp. Attackers may use service persistence or defense-impairment by placing executables in these locations and registering them as services. The detection relies on registry_set events capturing TargetObject under HKLM\System\CurrentControlSet\Services and ImagePath data containing suspicious directory paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml
author: Florian Roth (Nextron Systems), frack113, Huntrule Team
date: 2022-05-02
modified: 2025-10-07
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection_service_start:
    TargetObject|startswith: HKLM\System\CurrentControlSet\Services\
    TargetObject|endswith: \Start
    Image|contains:
      - \Users\Public\
      - \Perflogs\
      - \ADMIN$\
      - \Temp\
    Details:
      - DWORD (0x00000000)
      - DWORD (0x00000001)
      - DWORD (0x00000002)
  selection_service_imagepath:
    TargetObject|startswith: HKLM\System\CurrentControlSet\Services\
    TargetObject|endswith: \ImagePath
    Details|contains:
      - \Users\Public\
      - \Perflogs\
      - \ADMIN$\
      - \Temp\
  filter_optional_avast:
    Image|contains|all:
      - \Common Files\
      - \Temp\
  filter_optional_mbamservice:
    TargetObject|endswith: \CurrentControlSet\Services\MBAMInstallerService\ImagePath
    Details|endswith: \AppData\Local\Temp\MBAMInstallerService.exe"
    Image: C:\Windows\system32\services.exe
  condition: 1 of selection_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags creation or modification of a Windows service where the service’s registry values indicate an ImagePath located in commonly abused folders such as Users\Public, Perflogs, ADMIN$, or Temp. Attackers may use service persistence or defense-impairment by placing executables in these locations and registering them as services. The detection relies on registry_set events capturing TargetObject under HKLM\System\CurrentControlSet\Services and ImagePath data containing suspicious directory paths.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.