huntrule

Windows Service Control Manager: HackTool Service Registration or Execution

Detects Windows service creation/start events tied to hacktool-like service names or ImagePath indicators.

FreeUnreviewedSigmahighv1
title: "Windows Service Control Manager: HackTool Service Registration or Execution"
id: 7db675a5-265e-46e1-89fe-d7786b6b3ac3
status: test
description: This rule flags Windows system service events where the Service Control Manager reports creation, change, or start activity for services matching known hacktool service names. Attackers often register malicious services to run code persistently with elevated privileges, so identifying these registrations/executions is important for containment. It relies on Windows System log events 7045 and 7036 from the Service Control Manager, plus service name and ImagePath content indicators such as specific hacktool-like strings and the substring 'bypass'.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_hacktools.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-21
modified: 2023-08-07
tags:
  - attack.execution
  - attack.t1569.002
  - attack.s0029
logsource:
  product: windows
  service: system
detection:
  selection_eid:
    Provider_Name: Service Control Manager
    EventID:
      - 7045
      - 7036
  selection_service_name:
    ServiceName|contains:
      - cachedump
      - DumpSvc
      - gsecdump
      - pwdump
      - UACBypassedService
      - WCE SERVICE
      - WCESERVICE
      - winexesvc
  selection_service_image:
    ImagePath|contains: bypass
  condition: selection_eid and 1 of selection_service_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d26ce60c-2151-403c-9a42-49420d87b5e4
    type: derived

What it detects

This rule flags Windows system service events where the Service Control Manager reports creation, change, or start activity for services matching known hacktool service names. Attackers often register malicious services to run code persistently with elevated privileges, so identifying these registrations/executions is important for containment. It relies on Windows System log events 7045 and 7036 from the Service Control Manager, plus service name and ImagePath content indicators such as specific hacktool-like strings and the substring 'bypass'.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.