Windows Service Creation: ProcessHacker Privilege Elevation via Service Control Manager

title: "Windows Service Creation: ProcessHacker Privilege Elevation via Service Control Manager"
id: b0eb5fb4-3de1-45b8-a7bd-f2c0981f69a8
status: test
description: This rule identifies creation of a service named with a ProcessHacker prefix where the service runs as LocalSystem, as reported by the Service Control Manager (EventID 7045). Such behavior matters because it indicates an installed component that can execute with the highest local privileges. The detection relies on Windows System telemetry for service installation events including Provider_Name, EventID, ServiceName, and AccountName.
references:
  - https://twitter.com/1kwpeter/status/1397816101455765504
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_pua_proceshacker.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-05-27
modified: 2022-12-25
tags:
  - attack.persistence
  - attack.execution
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName|startswith: ProcessHacker
    AccountName: LocalSystem
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9
    type: derived