Windows Security 4697 Detects VAR++ LAUNCHER Obfuscated PowerShell in ServiceFileName

title: Windows Security 4697 Detects VAR++ LAUNCHER Obfuscated PowerShell in ServiceFileName
id: b180f0c5-7296-4075-af53-ef34895c4e76
related:
  - id: 14bcba49-a428-42d9-b943-e2ce0f0f7ae6
    type: derived
  - id: 4c54ba8f-73d2-4d40-8890-d9cf1dca3d30
    type: derived
status: test
description: This rule flags Windows Security audit events (EID 4697) where the created service binary path contains obfuscated PowerShell construction patterns associated with VAR++ LAUNCHER-style launchers. Attackers often use obfuscation to hide PowerShell commands delivered through service execution, helping them evade straightforward command-string detections. The rule relies on Security event telemetry that captures the service's ServiceFileName contents and matches specific string fragments indicative of command concatenation and formatting.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_via_var_services_security.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains|all:
      - "&&set"
      - cmd
      - /c
      - -f
    ServiceFileName|contains:
      - "{0}"
      - "{1}"
      - "{2}"
      - "{3}"
      - "{4}"
      - "{5}"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1