Windows Service Control Manager: Mesh Agent Service Installation via Service Creation (7045)
Flags Windows Event ID 7045 service installations that reference MeshAgent.exe or “Mesh Agent”.
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-11-28
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows Service Control Manager events where a new service is created with an image path containing MeshAgent.exe and a service name containing "Mesh Agent". Attackers can use installed services to persistently run remote management components, making service creation a high-signal indicator for unauthorized deployment. It relies on Windows System service installation telemetry from Event ID 7045, including the service name and image path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Service Control Manager: Mesh Agent Service Installation via Service Creation (7045)"
id: ef4c0949-41fa-44f4-8e68-1933527c4ea7
status: test
description: This rule flags Windows Service Control Manager events where a new service is created with an image path containing MeshAgent.exe and a service name containing "Mesh Agent". Attackers can use installed services to persistently run remote management components, making service creation a high-signal indicator for unauthorized deployment. It relies on Windows System service installation telemetry from Event ID 7045, including the service name and image path.
references:
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_mesh_agent.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-28
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
service: system
detection:
selection_root:
Provider_Name: Service Control Manager
EventID: 7045
selection_service:
- ImagePath|contains: MeshAgent.exe
- ServiceName|contains: Mesh Agent
condition: all of selection_*
falsepositives:
- Legitimate use of the tool
level: medium
license: DRL-1.1
related:
- id: e0d1ad53-c7eb-48ec-a87a-72393cc6cedc
type: derived