Windows: Remote Utilities Host service installation via Service Control Manager (7045)

Alerts on Windows Event 7045 when a "Remote Utilities - Host" service is installed from rutserv.exe -service.

FreeUnreviewedSigmamediumv1

windows-remote-utilities-host-service-installation-via-service-control-manager-7-85cce894

title: "Windows: Remote Utilities Host service installation via Service Control Manager (7045)"
id: 13cfa9fa-4860-47c9-a47f-91b5ea1b10b4
status: test
description: This rule flags Windows service creation events where the Service Control Manager reports a new service named "Remote Utilities - Host". It specifically matches the installed binary path containing "\rutserv.exe" with the "-service" argument, indicating the host service component being registered. Attackers may use Remote Utilities host services to maintain remote access persistence, so correlating service installation telemetry (Event ID 7045) is important for identifying unauthorized or unexpected service additions.
references:
  - https://www.remoteutilities.com/support/kb/host-service-won-t-start/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_remote_utilities.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-31
tags:
  - attack.persistence
logsource:
  product: windows
  service: system
detection:
  selection_root:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service:
    - ImagePath|contains|all:
        - \rutserv.exe
        - -service
    - ServiceName: Remote Utilities - Host
  condition: all of selection_*
falsepositives:
  - Legitimate use of the tool
level: medium
license: DRL-1.1
related:
  - id: 85cce894-dd8b-4427-a958-5cc47a4dc9b9
    type: derived

What it detects

This rule flags Windows service creation events where the Service Control Manager reports a new service named "Remote Utilities - Host". It specifically matches the installed binary path containing "\rutserv.exe" with the "-service" argument, indicating the host service component being registered. Attackers may use Remote Utilities host services to maintain remote access persistence, so correlating service installation telemetry (Event ID 7045) is important for identifying unauthorized or unexpected service additions.

Known false positives

Legitimate use of the tool

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.