Windows Service Creation for Backdoor Persistence via GoogleUpdate (Event ID 7045)
Flags creation of a "GoogleUpdate" Windows service with rundll32/FileProtocolHandler image path pointing to ProgramData persistence.
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-15
- Updated
- 2026-07-31
What it detects
This rule identifies Windows system service creation events (Event ID 7045) where the new service is named "GoogleUpdate" and its binary path includes rundll32, FileProtocolHandler, and a ProgramData-based GoogleUpdate executable. This pattern is used to establish persistence, allowing an attacker-controlled component to run as a Windows service. Detection relies on Windows Service Control Manager telemetry reporting provider name, service name, event ID, and the configured ImagePath details.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Service Creation for Backdoor Persistence via GoogleUpdate (Event ID 7045)
id: c9d774a0-eaa4-4d7f-a758-48626e5ea368
status: test
description: This rule identifies Windows system service creation events (Event ID 7045) where the new service is named "GoogleUpdate" and its binary path includes rundll32, FileProtocolHandler, and a ProgramData-based GoogleUpdate executable. This pattern is used to establish persistence, allowing an attacker-controlled component to run as a Windows service. Detection relies on Windows Service Control Manager telemetry reporting provider name, service name, event ID, and the configured ImagePath details.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/win_system_malware_goofy_guineapig_service_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
tags:
- attack.persistence
- detection.emerging-threats
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: Service Control Manager
EventID: 7045
ServiceName: GoogleUpdate
ImagePath|contains|all:
- rundll32
- FileProtocolHandler
- \ProgramData\GoogleUpdate\GoogleUpdate.exe
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 8c15dd74-9570-4f48-80b2-29996fd91ee6
type: derived