Windows Service Control Manager 7045: Suspicious Cobalt Strike Service ImagePath Patterns

title: "Windows Service Control Manager 7045: Suspicious Cobalt Strike Service ImagePath Patterns"
id: 889a2160-673a-4351-b401-2a29f8bd3d2f
status: test
description: This rule flags Windows Service Control Manager events (EventID 7045) where a newly created service points to a suspicious executable path associated with Cobalt Strike usage. Attackers commonly install services to achieve persistence, execute payloads, and facilitate privilege escalation or lateral movement. The detection relies on telemetry from the service installation event and matches multiple suspicious ImagePath substrings, including references to ADMIN$ and PowerShell command patterns such as hidden/encoded execution and local download string usage.
references:
  - https://www.sans.org/webcasts/119395
  - https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
  - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_cobaltstrike_service_installs.yml
author: Florian Roth (Nextron Systems), Wojciech Lesicki, Huntrule Team
date: 2021-05-26
modified: 2022-11-27
tags:
  - attack.persistence
  - attack.execution
  - attack.privilege-escalation
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1543.003
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection_id:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection1:
    ImagePath|contains|all:
      - ADMIN$
      - .exe
  selection2:
    ImagePath|contains|all:
      - "%COMSPEC%"
      - start
      - powershell
  selection3:
    ImagePath|contains: powershell -nop -w hidden -encodedcommand
  selection4:
    ImagePath|base64offset|contains: "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:"
  condition: selection_id and (selection1 or selection2 or selection3 or selection4)
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 5a105d34-05fc-401e-8553-272b45c1522d
    type: derived