Windows Service Control Manager Events: Suspicious Service Install Paths used by Cobalt Strike
Alerts on Windows 7045 service installs with ImagePath patterns consistent with Cobalt Strike-style PowerShell and execution.
- Product
- windows
- Service
- system
- Author
- Florian Roth (Nextron Systems), Wojciech Lesicki (SigmaHQ), DRL 1.1
- Published
- 2021-05-26
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows service creation events (EventID 7045) where the installed service ImagePath matches patterns commonly used in Cobalt Strike service-based execution and related privilege or lateral movement activity. Attackers may abuse Windows services for persistence and remote execution by installing services that launch command interpreters or encoded PowerShell payloads. The detection relies on Service Control Manager telemetry from EventID 7045, specifically the Provider name and the contents of the service ImagePath field.
Reporting behind it
- sans.orghttps://www.sans.org/webcasts/119395
- crowdstrike.comhttps://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
- thedfirreport.comhttps://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_cobaltstrike_service_installs.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Service Control Manager Events: Suspicious Service Install Paths used by Cobalt Strike"
id: 889a2160-673a-4351-b401-2a29f8bd3d2f
status: test
description: This rule flags Windows service creation events (EventID 7045) where the installed service ImagePath matches patterns commonly used in Cobalt Strike service-based execution and related privilege or lateral movement activity. Attackers may abuse Windows services for persistence and remote execution by installing services that launch command interpreters or encoded PowerShell payloads. The detection relies on Service Control Manager telemetry from EventID 7045, specifically the Provider name and the contents of the service ImagePath field.
references:
- https://www.sans.org/webcasts/119395
- https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
- https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_cobaltstrike_service_installs.yml
author: Florian Roth (Nextron Systems), Wojciech Lesicki, Huntrule Team
date: 2021-05-26
modified: 2022-11-27
tags:
- attack.persistence
- attack.execution
- attack.privilege-escalation
- attack.lateral-movement
- attack.t1021.002
- attack.t1543.003
- attack.t1569.002
logsource:
product: windows
service: system
detection:
selection_id:
Provider_Name: Service Control Manager
EventID: 7045
selection1:
ImagePath|contains|all:
- ADMIN$
- .exe
selection2:
ImagePath|contains|all:
- "%COMSPEC%"
- start
- powershell
selection3:
ImagePath|contains: powershell -nop -w hidden -encodedcommand
selection4:
ImagePath|base64offset|contains: "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:"
condition: selection_id and (selection1 or selection2 or selection3 or selection4)
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 5a105d34-05fc-401e-8553-272b45c1522d
type: derived