Windows Service Control Manager detects Sliver C2 default service installations via service creation events
Alerts on Service Control Manager EventID 7045 for Sliver service installations using a known Temp-staged EXE path pattern.
- Product
- windows
- Service
- system
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-25
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Service Control Manager events where a new service is installed with a ServiceName matching Sliver ("Sliver" or "Sliver implant") and the service binary is created from a short-named executable in \Windows\Temp. Such service installations can provide attackers persistence and reliable command execution as Windows services. Detection relies on telemetry from System service creation events (EventID 7045) including ServiceName and ImagePath.
Reporting behind it
- github.comhttps://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/client/command/commands.go#L1231
- microsoft.comhttps://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_sliver.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Service Control Manager detects Sliver C2 default service installations via service creation events
id: 0b527543-7dbc-4baa-8d22-677e90b76b1c
status: test
description: This rule flags Windows Service Control Manager events where a new service is installed with a ServiceName matching Sliver ("Sliver" or "Sliver implant") and the service binary is created from a short-named executable in \Windows\Temp. Such service installations can provide attackers persistence and reliable command execution as Windows services. Detection relies on telemetry from System service creation events (EventID 7045) including ServiceName and ImagePath.
references:
- https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/client/command/commands.go#L1231
- https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_sliver.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-25
tags:
- attack.persistence
- attack.execution
- attack.privilege-escalation
- attack.t1543.003
- attack.t1569.002
logsource:
product: windows
service: system
detection:
selection_eid:
Provider_Name: Service Control Manager
EventID: 7045
selection_service_1:
ImagePath|re: ^[a-zA-Z]:\\windows\\temp\\[a-zA-Z0-9]{10}\.exe
selection_service_2:
ServiceName:
- Sliver
- Sliver implant
condition: selection_eid and 1 of selection_service_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 31c51af6-e7aa-4da7-84d4-8f32cc580af2
type: derived