Windows Registry Service Install Indicators for Cobalt Strike Staging
Identifies suspicious Windows service installation registry writes tied to ADMIN$/.exe and %COMSPEC% start powershell patterns.
- Product
- windows
- Category
- registry_set
- Author
- Wojciech Lesicki (SigmaHQ), DRL 1.1
- Published
- 2021-06-29
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry activity consistent with creating or updating Windows services under the CurrentControlSet/ControlSet service paths. It matches service definitions whose Details contain ADMIN$ and an .exe payload, and whose command string includes %COMSPEC%, start, and powershell. Such patterns matter because service-based execution is a common way for attackers to establish persistence and run commands on remote or lateral systems. The detection relies on Windows registry_set telemetry, specifically the TargetObject and Details fields captured during registry writes.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Service Install Indicators for Cobalt Strike Staging
id: ccb32ee8-51fc-426f-b482-43908672f85f
status: test
description: This rule flags registry activity consistent with creating or updating Windows services under the CurrentControlSet/ControlSet service paths. It matches service definitions whose Details contain ADMIN$ and an .exe payload, and whose command string includes %COMSPEC%, start, and powershell. Such patterns matter because service-based execution is a common way for attackers to establish persistence and run commands on remote or lateral systems. The detection relies on Windows registry_set telemetry, specifically the TargetObject and Details fields captured during registry writes.
references:
- https://www.sans.org/webcasts/tech-tuesday-workshop-cobalt-strike-detection-log-analysis-119395
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_cobaltstrike_service_installs.yml
author: Wojciech Lesicki, Huntrule Team
date: 2021-06-29
modified: 2024-03-25
tags:
- attack.persistence
- attack.execution
- attack.privilege-escalation
- attack.lateral-movement
- attack.t1021.002
- attack.t1543.003
- attack.t1569.002
logsource:
category: registry_set
product: windows
detection:
selection_key:
- TargetObject|contains: \System\CurrentControlSet\Services
- TargetObject|contains|all:
- \System\ControlSet
- \Services
selection_details:
- Details|contains|all:
- ADMIN$
- .exe
- Details|contains|all:
- "%COMSPEC%"
- start
- powershell
condition: all of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 61a7697c-cb79-42a8-a2ff-5f0cdfae0130
type: derived