huntrule

Windows Service Creation via Suspicious Command-Line ImagePath (Event ID 7045)

Alerts on Windows service creation (7045) with ImagePath patterns indicating hidden/staged command execution.

FreeUnreviewedSigmahighv1
title: Windows Service Creation via Suspicious Command-Line ImagePath (Event ID 7045)
id: 7cf04358-f500-4da6-b418-3507234eb9c8
related:
  - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53
    type: obsolete
  - id: 26481afe-db26-4228-b264-25a29fe6efc7
    type: similar
  - id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b
    type: derived
status: test
description: This rule flags Windows service installations where the Service Control Manager reports Event ID 7045 and the service ImagePath contains suspicious command-line patterns. These strings commonly indicate execution of hidden or staged commands and references to temporary downloads, UNC/Admin shares, or typical staging locations, which can be used to establish persistence or run attacker-controlled code as a service. It relies on Windows System telemetry for Event ID 7045 and inspection of the ImagePath field for specific substrings.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_susp.yml
author: pH-T (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-18
modified: 2023-12-04
tags:
  - attack.persistence
  - attack.privilege-escalation
  - car.2013-09-005
  - attack.t1543.003
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains:
      - " -nop "
      - " -sta "
      - " -w hidden "
      - :\Temp\
      - .downloadfile(
      - .downloadstring(
      - \ADMIN$\
      - \Perflogs\
      - "&&"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows service installations where the Service Control Manager reports Event ID 7045 and the service ImagePath contains suspicious command-line patterns. These strings commonly indicate execution of hidden or staged commands and references to temporary downloads, UNC/Admin shares, or typical staging locations, which can be used to establish persistence or run attacker-controlled code as a service. It relies on Windows System telemetry for Event ID 7045 and inspection of the ImagePath field for specific substrings.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.