Windows Registry: Service configured with image path in suspicious public/temp folders
Detects Windows service ImagePath pointing to Users\Public, Perflogs, ADMIN$, or Temp based on registry_set events.
- Product
- windows
- Category
- registry_set
- Author
- Florian Roth (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-05-02
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags creation or modification of a Windows service where the service’s registry values indicate an ImagePath located in commonly abused folders such as Users\Public, Perflogs, ADMIN$, or Temp. Attackers may use service persistence or defense-impairment by placing executables in these locations and registering them as services. The detection relies on registry_set events capturing TargetObject under HKLM\System\CurrentControlSet\Services and ImagePath data containing suspicious directory paths.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Service configured with image path in suspicious public/temp folders"
id: e2f2523a-ee51-4d5a-bd20-d2e6fea929d0
related:
- id: c0abc838-36b0-47c9-b3b3-a90c39455382
type: obsolete
- id: a07f0359-4c90-4dc4-a681-8ffea40b4f47
type: derived
status: test
description: This rule flags creation or modification of a Windows service where the service’s registry values indicate an ImagePath located in commonly abused folders such as Users\Public, Perflogs, ADMIN$, or Temp. Attackers may use service persistence or defense-impairment by placing executables in these locations and registering them as services. The detection relies on registry_set events capturing TargetObject under HKLM\System\CurrentControlSet\Services and ImagePath data containing suspicious directory paths.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml
author: Florian Roth (Nextron Systems), frack113, Huntrule Team
date: 2022-05-02
modified: 2025-10-07
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
logsource:
category: registry_set
product: windows
detection:
selection_service_start:
TargetObject|startswith: HKLM\System\CurrentControlSet\Services\
TargetObject|endswith: \Start
Image|contains:
- \Users\Public\
- \Perflogs\
- \ADMIN$\
- \Temp\
Details:
- DWORD (0x00000000)
- DWORD (0x00000001)
- DWORD (0x00000002)
selection_service_imagepath:
TargetObject|startswith: HKLM\System\CurrentControlSet\Services\
TargetObject|endswith: \ImagePath
Details|contains:
- \Users\Public\
- \Perflogs\
- \ADMIN$\
- \Temp\
filter_optional_avast:
Image|contains|all:
- \Common Files\
- \Temp\
filter_optional_mbamservice:
TargetObject|endswith: \CurrentControlSet\Services\MBAMInstallerService\ImagePath
Details|endswith: \AppData\Local\Temp\MBAMInstallerService.exe"
Image: C:\Windows\system32\services.exe
condition: 1 of selection_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: high
license: DRL-1.1