Windows Service Creation Indicators for Moriya Rootkit (ZzNetSvc via Service Control Manager)

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1543.003Windows Service
Priv Esc
- T1543.003Windows Service
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags a Windows Service Control Manager event where service creation matches the specific service name ZzNetSvc (EventID 7045). Attackers using Moriya-related persistence mechanisms may install or register services to maintain control on a system. The detection relies on Windows System telemetry for service creation events reported by the Service Control Manager, capturing the service name and event details.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange

Suspicious Service DLL Hijack of IKEEXT or PrintNotify

Service Hiding via SC Sdset Security Descriptor Modification

Malicious Service DLL Hijack for Persistence via Lotus Blossom

Malicious TinyTurla ServiceDll Registration via svchost Group (via registry_set)

Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe

Malicious Service Creation With Autostart binPath via sc.exe (via process_creation)

Malicious svchost Service Creation for TinyTurla Persistence (via process_creation)

Malicious Service Creation Masquerading as nslookup (via process_creation)

Interactive Service Creation Executing cmd via sc.exe

Windows Service Creation Indicators for Moriya Rootkit (ZzNetSvc via Service Control Manager)

Pivot detection · T1543.003 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-service-creation-moriya-rootkit-related-zznetsvc-via-service-control-man-25b9c01c

title: Windows Service Creation Indicators for Moriya Rootkit (ZzNetSvc via Service Control Manager)
id: 5e33a81f-bd0c-4305-a7ab-40f39c2688dd
status: test
description: This rule flags a Windows Service Control Manager event where service creation matches the specific service name ZzNetSvc (EventID 7045). Attackers using Moriya-related persistence mechanisms may install or register services to maintain control on a system. The detection relies on Windows System telemetry for service creation events reported by the Service Control Manager, capturing the service name and event details.
references:
  - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_moriya_rootkit.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-05-06
modified: 2022-11-29
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName: ZzNetSvc
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 25b9c01c-350d-4b95-bed1-836d04a4f324
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL