Windows RTCore64 Service Installation via Service Control Manager (Event ID 7045)
Alerts on creation of the RTCore64 Windows service via Service Control Manager Event ID 7045.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-30
- Updated
- 2026-07-31
What it detects
This rule identifies the installation of the RTCore64 Windows service, observed through Service Control Manager events with Event ID 7045. Attackers and misuse cases may persist or run privileged components by creating new services, making this event a useful persistence signal. It relies on Windows service installation telemetry, specifically the service provider name and service name fields reported by Event ID 7045.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-rtcore64-service-installation-event-id-7045-91c49341
title: Windows RTCore64 Service Installation via Service Control Manager (Event ID 7045)
id: b5f90309-fc8c-473b-834f-4e0d8440f3cf
status: test
description: This rule identifies the installation of the RTCore64 Windows service, observed through Service Control Manager events with Event ID 7045. Attackers and misuse cases may persist or run privileged components by creating new services, making this event a useful persistence signal. It relies on Windows service installation telemetry, specifically the service provider name and service name fields reported by Event ID 7045.
references:
- https://github.com/br-sn/CheekyBlinder/blob/e1764a8a0e7cda8a3716aefa35799f560686e01c/CheekyBlinder/CheekyBlinder.cpp
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_susp_rtcore64_service_install.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-30
tags:
- attack.persistence
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: Service Control Manager
EventID: 7045
ServiceName: RTCore64
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 91c49341-e2ef-40c0-ac45-49ec5c3fe26c
type: derived