Windows Remote Utilities Host Service Installation via Service Control Manager (EventID 7045)
Alerts on Windows Event 7045 when a "Remote Utilities - Host" service is installed from rutserv.exe -service.
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-31
- Updated
- 2026-07-31
What it detects
This rule identifies installation of the “Remote Utilities - Host” Windows service by matching Service Control Manager event 7045 for the service name and an ImagePath containing rutserv.exe with the -service argument. Creating or installing services can provide persistence and remote access capabilities for an attacker or authorized admin tooling. The detection relies on Windows service installation telemetry from the Service Control Manager (EventID 7045), including ServiceName, ImagePath, and the initiating process context provided in that event.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Remote Utilities Host Service Installation via Service Control Manager (EventID 7045)
id: 13cfa9fa-4860-47c9-a47f-91b5ea1b10b4
status: test
description: This rule identifies installation of the “Remote Utilities - Host” Windows service by matching Service Control Manager event 7045 for the service name and an ImagePath containing rutserv.exe with the -service argument. Creating or installing services can provide persistence and remote access capabilities for an attacker or authorized admin tooling. The detection relies on Windows service installation telemetry from the Service Control Manager (EventID 7045), including ServiceName, ImagePath, and the initiating process context provided in that event.
references:
- https://www.remoteutilities.com/support/kb/host-service-won-t-start/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_remote_utilities.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-31
tags:
- attack.persistence
logsource:
product: windows
service: system
detection:
selection_root:
Provider_Name: Service Control Manager
EventID: 7045
selection_service:
- ImagePath|contains|all:
- \rutserv.exe
- -service
- ServiceName: Remote Utilities - Host
condition: all of selection_*
falsepositives:
- Legitimate use of the tool
level: medium
license: DRL-1.1
related:
- id: 85cce894-dd8b-4427-a958-5cc47a4dc9b9
type: derived