Windows Service Creation via SCM (Event ID 7045) with svchost.exe and specific service names

title: Windows Service Creation via SCM (Event ID 7045) with svchost.exe and specific service names
id: 43033e29-8857-40af-bc28-8009e6885ead
status: test
description: This rule flags Windows Service Control Manager events (Event ID 7045) indicating creation of a new service where the configured ImagePath contains svchost.exe and the ServiceName matches specific values. Attackers may use new Windows services to gain persistence and execution under the Service Control Manager. Detection relies on Windows service creation telemetry from the System event log, including Provider_Name, EventID, ServiceName, and ImagePath contents.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/win_system_malware_coldsteel_persistence_service.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-02
tags:
  - attack.persistence
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName:
      - Name
      - msupdate
      - msupdate2
    ImagePath|contains: \Windows\System32\svchost.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 3ced239c-7285-4b54-99c4-8525b69293f7
    type: derived