Windows Service Creation via SCM (Event ID 7045) with svchost.exe and specific service names
Alerts on Windows 7045 service creations where ImagePath contains svchost.exe and service names match Name/msupdate/msupdate2.
FreeReviewedSigma · High · v5
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-02
- Updated
- 2026-07-31
What it detects
This rule flags Windows Service Control Manager events (Event ID 7045) indicating creation of a new service where the configured ImagePath contains svchost.exe and the ServiceName matches specific values. Attackers may use new Windows services to gain persistence and execution under the Service Control Manager. Detection relies on Windows service creation telemetry from the System event log, including Provider_Name, EventID, ServiceName, and ImagePath contents.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-service-creation-via-service-control-manager-7045-with-svchost-exe-image-3ced239c
title: Windows Service Creation via SCM (Event ID 7045) with svchost.exe and specific service names
id: 43033e29-8857-40af-bc28-8009e6885ead
status: test
description: This rule flags Windows Service Control Manager events (Event ID 7045) indicating creation of a new service where the configured ImagePath contains svchost.exe and the ServiceName matches specific values. Attackers may use new Windows services to gain persistence and execution under the Service Control Manager. Detection relies on Windows service creation telemetry from the System event log, including Provider_Name, EventID, ServiceName, and ImagePath contents.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/win_system_malware_coldsteel_persistence_service.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-02
tags:
- attack.persistence
- detection.emerging-threats
- attack.stealth
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: Service Control Manager
EventID: 7045
ServiceName:
- Name
- msupdate
- msupdate2
ImagePath|contains: \Windows\System32\svchost.exe
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 3ced239c-7285-4b54-99c4-8525b69293f7
type: derived