Windows RTCore64 Service Installation (Event ID 7045)

title: Windows RTCore64 Service Installation (Event ID 7045)
id: b5f90309-fc8c-473b-834f-4e0d8440f3cf
status: test
description: This rule flags the creation of a Windows service named RTCore64 using Service Control Manager events with Event ID 7045. Adversaries may install or persist via new services to execute code at system startup or during service control operations. The detection relies on Windows service installation telemetry captured in the 7045 event, specifically matching the Provider_Name and ServiceName fields.
references:
  - https://github.com/br-sn/CheekyBlinder/blob/e1764a8a0e7cda8a3716aefa35799f560686e01c/CheekyBlinder/CheekyBlinder.cpp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_susp_rtcore64_service_install.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-30
tags:
  - attack.persistence
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName: RTCore64
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 91c49341-e2ef-40c0-ac45-49ec5c3fe26c
    type: derived