Windows Service Control Manager: CSExec Service Installation (EventID 7045)

title: "Windows Service Control Manager: CSExec Service Installation (EventID 7045)"
id: 7abf8ed3-5b8c-43c4-a5ae-240f93995caa
status: test
description: This rule identifies Windows Service Control Manager events where a service named csexecsvc is installed, specifically when the configured image path ends with \csexecsvc.exe. Attackers may use this pattern to deploy and launch a remote execution component via a Windows service. It relies on System service installation telemetry, matching EventID 7045 with the provider name and service/image path indicators.
references:
  - https://github.com/malcomvetter/CSExec
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_csexecsvc.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-07
tags:
  - attack.execution
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection_eid:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service:
    - ServiceName: csexecsvc
    - ImagePath|endswith: \csexecsvc.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a27e5fa9-c35e-4e3d-b7e0-1ce2af66ad12
    type: derived