Windows Service Control Manager detects RemComSvc service installation

title: Windows Service Control Manager detects RemComSvc service installation
id: 80838c0a-0fce-40ca-a81a-c2f50dc839eb
status: test
description: This rule identifies installation (and associated execution context) of the RemComSvc Windows service by matching Service Control Manager event 7045. Attackers may use this type of service for persistence or to launch malicious components under Windows service infrastructure. It relies on Windows System service installation telemetry containing the provider name, service name, and the service binary path ending with \RemComSvc.exe.
references:
  - https://github.com/kavika13/RemCom/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_remcom.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-07
tags:
  - attack.execution
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection_eid:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service:
    - ServiceName: RemComSvc
    - ImagePath|endswith: \RemComSvc.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9e36ed87-4986-482e-8e3b-5c23ffff11bf
    type: derived