Windows Service Creation: Moriya rootkit-related ZzNetSvc via Service Control Manager (Event ID 7045)

title: "Windows Service Creation: Moriya rootkit-related ZzNetSvc via Service Control Manager (Event ID 7045)"
id: 5e33a81f-bd0c-4305-a7ab-40f39c2688dd
status: test
description: This rule flags Windows System logs indicating a service named "ZzNetSvc" was created by the Service Control Manager using Event ID 7045. Attackers commonly install or persist through new services, and this specific service name is associated with the Moriya rootkit behavior described in the referenced report. The detection relies on Windows service installation telemetry (Provider_Name, EventID, and ServiceName) captured in the System service log stream.
references:
  - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_moriya_rootkit.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-05-06
modified: 2022-11-29
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName: ZzNetSvc
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 25b9c01c-350d-4b95-bed1-836d04a4f324
    type: derived