Windows Service Creation for Goofy Guineapig Backdoor Persistence via rundll32

Flags creation of a "GoogleUpdate" Windows service with rundll32/FileProtocolHandler image path pointing to ProgramData persistence.

FreeUnreviewedSigmacriticalv1

windows-service-creation-for-goofy-guineapig-backdoor-persistence-via-rundll32-8c15dd74

title: Windows Service Creation for Goofy Guineapig Backdoor Persistence via rundll32
id: c9d774a0-eaa4-4d7f-a758-48626e5ea368
status: test
description: This rule identifies Windows Service Control Manager events where a new service named "GoogleUpdate" is created with an ImagePath containing rundll32 and FileProtocolHandler, pointing to \ProgramData\GoogleUpdate\GoogleUpdate.exe. Creating a persistent service in this way can maintain malware execution across reboots. It relies on Windows System service creation telemetry (Event ID 7045) including the service name and the service image path.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/win_system_malware_goofy_guineapig_service_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName: GoogleUpdate
    ImagePath|contains|all:
      - rundll32
      - FileProtocolHandler
      - \ProgramData\GoogleUpdate\GoogleUpdate.exe
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 8c15dd74-9570-4f48-80b2-29996fd91ee6
    type: derived

What it detects

This rule identifies Windows Service Control Manager events where a new service named "GoogleUpdate" is created with an ImagePath containing rundll32 and FileProtocolHandler, pointing to \ProgramData\GoogleUpdate\GoogleUpdate.exe. Creating a persistent service in this way can maintain malware execution across reboots. It relies on Windows System service creation telemetry (Event ID 7045) including the service name and the service image path.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.