Windows Service Creation for Backdoor Persistence via GoogleUpdate (Event ID 7045)

title: Windows Service Creation for Backdoor Persistence via GoogleUpdate (Event ID 7045)
id: c9d774a0-eaa4-4d7f-a758-48626e5ea368
status: test
description: This rule identifies Windows system service creation events (Event ID 7045) where the new service is named "GoogleUpdate" and its binary path includes rundll32, FileProtocolHandler, and a ProgramData-based GoogleUpdate executable. This pattern is used to establish persistence, allowing an attacker-controlled component to run as a Windows service. Detection relies on Windows Service Control Manager telemetry reporting provider name, service name, event ID, and the configured ImagePath details.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/win_system_malware_goofy_guineapig_service_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName: GoogleUpdate
    ImagePath|contains|all:
      - rundll32
      - FileProtocolHandler
      - \ProgramData\GoogleUpdate\GoogleUpdate.exe
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 8c15dd74-9570-4f48-80b2-29996fd91ee6
    type: derived