Windows Service Control Manager detects Sliver service installation via default Temp EXE path

title: Windows Service Control Manager detects Sliver service installation via default Temp EXE path
id: 0b527543-7dbc-4baa-8d22-677e90b76b1c
status: test
description: 'This rule flags Windows Service Control Manager events (EventID 7045) where a service named "Sliver" or "Sliver implant" is installed and the service binary path matches a known malicious pattern: an executable staged in \Windows\Temp with a 10-character filename. Attackers can use this mechanism to achieve persistence by registering a service that launches their implant. The detection relies on Windows system service-install telemetry from the Service Control Manager and matches both the event and the specific service/image-path indicators.'
references:
  - https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/client/command/commands.go#L1231
  - https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_sliver.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-25
tags:
  - attack.persistence
  - attack.execution
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection_eid:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service_1:
    ImagePath|re: ^[a-zA-Z]:\\windows\\temp\\[a-zA-Z0-9]{10}\.exe
  selection_service_2:
    ServiceName:
      - Sliver
      - Sliver implant
  condition: selection_eid and 1 of selection_service_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 31c51af6-e7aa-4da7-84d4-8f32cc580af2
    type: derived