Windows Service Install (System Event 7045) for Turla-Associated Service Names

title: Windows Service Install (System Event 7045) for Turla-Associated Service Names
id: e9924395-eb0e-41d3-95b2-a3749907f689
status: test
description: This rule flags Windows Service Control Manager creation events where the service name matches specific strings (srservice, ipvpn, hkmsvc). Malicious service installs are a common persistence technique because they can start automatically and run with elevated privileges. Detection relies on System log Event ID 7045 telemetry, including the Provider_Name and the ServiceName value.
references:
  - https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Turla/win_system_apt_carbonpaper_turla.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-31
modified: 2021-11-30
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.g0010
  - attack.t1543.003
  - detection.emerging-threats
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName:
      - srservice
      - ipvpn
      - hkmsvc
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1df8b3da-b0ac-4d8a-b7c7-6cb7c24160e4
    type: derived