Windows Service Creation via Service Control Manager (7045) with svchost.exe ImagePath

title: Windows Service Creation via Service Control Manager (7045) with svchost.exe ImagePath
id: 43033e29-8857-40af-bc28-8009e6885ead
status: test
description: This rule flags Windows System service creation events (EventID 7045) attributed to the Service Control Manager when the service ImagePath contains svchost.exe. It also focuses on specific service names, including msupdate and msupdate2, which are commonly used to blend in with legitimate update-related naming. Attackers may use new services to persist and execute payloads under the Windows service host process; detection relies on Windows service creation telemetry from System event logs.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/win_system_malware_coldsteel_persistence_service.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-02
tags:
  - attack.persistence
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName:
      - Name
      - msupdate
      - msupdate2
    ImagePath|contains: \Windows\System32\svchost.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 3ced239c-7285-4b54-99c4-8525b69293f7
    type: derived