Windows Service Creation: TacticalRMM Agent Service (SCM Event ID 7045)

title: "Windows Service Creation: TacticalRMM Agent Service (SCM Event ID 7045)"
id: c132fd82-c436-4dd4-b9e9-71f5c74ffb3b
status: test
description: This rule identifies installation of a TacticalRMM-related Windows service by matching a Service Control Manager (System) event with Event ID 7045. It looks for a service image path containing tacticalrmm.exe and a service name containing TacticalRMM Agent Service, which can indicate remote monitoring tooling being deployed on a host. The detection relies on Windows service installation telemetry from the System log via Event ID 7045 and associated service fields.
references:
  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_tacticalrmm.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-28
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  service: system
detection:
  selection_root:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service:
    - ImagePath|contains: tacticalrmm.exe
    - ServiceName|contains: TacticalRMM Agent Service
  condition: all of selection_*
falsepositives:
  - Legitimate use of the tool
level: medium
license: DRL-1.1
related:
  - id: 4bb79b62-ef12-4861-981d-2aab43fab642
    type: derived