Windows Service Installation of MeshAgent.exe via Service Control Manager (Event ID 7045)

Flags Windows Event ID 7045 service installations that reference MeshAgent.exe or “Mesh Agent”.

FreeUnreviewedSigmamediumv1

windows-service-installation-of-meshagent-exe-via-service-control-manager-event--e0d1ad53

title: Windows Service Installation of MeshAgent.exe via Service Control Manager (Event ID 7045)
id: ef4c0949-41fa-44f4-8e68-1933527c4ea7
status: test
description: This rule identifies Windows service creation events where the Service Control Manager reports a new service and the configured path or name references MeshAgent.exe / “Mesh Agent”. Attackers may install such services to establish remote management and persistence for command-and-control workflows. The detection relies on Windows System service installation telemetry using Event ID 7045 fields for the service provider name, service name, and image path.
references:
  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_mesh_agent.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-28
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  service: system
detection:
  selection_root:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service:
    - ImagePath|contains: MeshAgent.exe
    - ServiceName|contains: Mesh Agent
  condition: all of selection_*
falsepositives:
  - Legitimate use of the tool
level: medium
license: DRL-1.1
related:
  - id: e0d1ad53-c7eb-48ec-a87a-72393cc6cedc
    type: derived

What it detects

This rule identifies Windows service creation events where the Service Control Manager reports a new service and the configured path or name references MeshAgent.exe / “Mesh Agent”. Attackers may install such services to establish remote management and persistence for command-and-control workflows. The detection relies on Windows System service installation telemetry using Event ID 7045 fields for the service provider name, service name, and image path.

Known false positives

Legitimate use of the tool

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.