Windows Registry: Service configured with image path in suspicious public/temp folders

Detects Windows service ImagePath pointing to Users\Public, Perflogs, ADMIN$, or Temp based on registry_set events.

FreeReviewedSigma · High · v1

Product: windows
Category: registry_set
Author: Florian Roth (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published: 2022-05-02
Updated: 2026-07-30

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
Priv Esc
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags creation or modification of a Windows service where the service’s registry values indicate an ImagePath located in commonly abused folders such as Users\Public, Perflogs, ADMIN$, or Temp. Attackers may use service persistence or defense-impairment by placing executables in these locations and registering them as services. The detection relies on registry_set events capturing TargetObject under HKLM\System\CurrentControlSet\Services and ImagePath data containing suspicious directory paths.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange

Suspicious Office VBA Object Model Access Enabled via Registry (via registry_set)

Suspicious PowerShell Payload Staging in HKCU Printers Registry Key

Suspicious Rootkit Configuration Registry Keys (via registry_set)

Suspicious Disabling of Chromium App-Bound Encryption via Policy Registry Key (via registry_set)

Windows reg.exe Registry Tampering of Internal Tool and Explorer Policy Settings (T1112)

Suspicious Disabling of Restricted Admin Mode via Registry (via registry_set)

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Theft (via registry_set)

Suspicious ClickFix RunMRU Entry Recording LOLBIN Command from Run Dialog

Suspicious Access to Chrome Encrypted Preference MAC Registry Values (via registry_set)

Windows Registry: Service configured with image path in suspicious public/temp folders

Pivot detection · T1112 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-service-configured-with-image-path-in-suspicious-public-temp-fo-a07f0359

title: "Windows Registry: Service configured with image path in suspicious public/temp folders"
id: e2f2523a-ee51-4d5a-bd20-d2e6fea929d0
related:
  - id: c0abc838-36b0-47c9-b3b3-a90c39455382
    type: obsolete
  - id: a07f0359-4c90-4dc4-a681-8ffea40b4f47
    type: derived
status: test
description: This rule flags creation or modification of a Windows service where the service’s registry values indicate an ImagePath located in commonly abused folders such as Users\Public, Perflogs, ADMIN$, or Temp. Attackers may use service persistence or defense-impairment by placing executables in these locations and registering them as services. The detection relies on registry_set events capturing TargetObject under HKLM\System\CurrentControlSet\Services and ImagePath data containing suspicious directory paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml
author: Florian Roth (Nextron Systems), frack113, Huntrule Team
date: 2022-05-02
modified: 2025-10-07
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection_service_start:
    TargetObject|startswith: HKLM\System\CurrentControlSet\Services\
    TargetObject|endswith: \Start
    Image|contains:
      - \Users\Public\
      - \Perflogs\
      - \ADMIN$\
      - \Temp\
    Details:
      - DWORD (0x00000000)
      - DWORD (0x00000001)
      - DWORD (0x00000002)
  selection_service_imagepath:
    TargetObject|startswith: HKLM\System\CurrentControlSet\Services\
    TargetObject|endswith: \ImagePath
    Details|contains:
      - \Users\Public\
      - \Perflogs\
      - \ADMIN$\
      - \Temp\
  filter_optional_avast:
    Image|contains|all:
      - \Common Files\
      - \Temp\
  filter_optional_mbamservice:
    TargetObject|endswith: \CurrentControlSet\Services\MBAMInstallerService\ImagePath
    Details|endswith: \AppData\Local\Temp\MBAMInstallerService.exe"
    Image: C:\Windows\system32\services.exe
  condition: 1 of selection_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL