Windows Service Control Manager: ProcessHacker service runs as LocalSystem

Flags Windows service installs for ProcessHacker-prefixed services running as LocalSystem.

FreeReviewedSigma · High · v2

Product: windows
Service: system
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-05-27
Updated: 2026-07-31

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1569.002Service Execution
Persistence
- T1543.003Windows Service
Priv Esc
- T1543.003Windows Service
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags creation of a Windows service named with a ProcessHacker prefix that runs under the LocalSystem account. Attackers may use ProcessHacker to attempt privilege escalation by leveraging a highly privileged service context. The detection relies on Windows System event telemetry for Service Control Manager service installation events, matching the service name prefix and the service account.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange

Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)

Windows Security Event 4697 Service Install of Remote Access Tools

Windows Service Control Manager detects Sliver C2 default service installations via service creation events

Windows Registry Service Install Indicators for Cobalt Strike Staging

Windows Service Control Manager Events: Suspicious Service Install Paths used by Cobalt Strike

Windows Security 4697 Alerts for Service Installations Using Cobalt Strike Beacon Payloads

Windows Service Creation: ServiceName javamtsup (Event ID 4697)

Suspicious Service DLL Hijack of IKEEXT or PrintNotify

Service Hiding via SC Sdset Security Descriptor Modification

Windows Service Control Manager: ProcessHacker service runs as LocalSystem

Pivot detection · T1543.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-service-creation-processhacker-privilege-elevation-via-service-control-m-c4ff1eac

title: "Windows Service Control Manager: ProcessHacker service runs as LocalSystem"
id: b0eb5fb4-3de1-45b8-a7bd-f2c0981f69a8
status: test
description: This rule flags creation of a Windows service named with a ProcessHacker prefix that runs under the LocalSystem account. Attackers may use ProcessHacker to attempt privilege escalation by leveraging a highly privileged service context. The detection relies on Windows System event telemetry for Service Control Manager service installation events, matching the service name prefix and the service account.
references:
  - https://twitter.com/1kwpeter/status/1397816101455765504
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_pua_proceshacker.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-05-27
modified: 2022-12-25
tags:
  - attack.persistence
  - attack.execution
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName|startswith: ProcessHacker
    AccountName: LocalSystem
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL