Windows Service Install: NtsSrv via Service Control Manager (7045)

title: "Windows Service Install: NtsSrv via Service Control Manager (7045)"
id: c6d87107-6cb5-43d9-9592-8f69e580158c
status: test
description: This rule identifies Windows service creation events where the Service Control Manager installs the NtsSrv service and the configured service image path ends with " LocalService". Service installation is a common persistence technique, and malicious services can be created to start automatically under a service account. Detection relies on Windows system service install telemetry (Event ID 7045) including Provider_Name, ServiceName, and ImagePath formatting.
references:
  - https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/StoneDrill/win_system_apt_stonedrill.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-07
modified: 2021-11-30
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.g0064
  - attack.t1543.003
  - detection.emerging-threats
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName: NtsSrv
    ImagePath|endswith: " LocalService"
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 9e987c6c-4c1e-40d8-bd85-dd26fba8fdd6
    type: derived