huntrule

Windows Service Control Manager: Mesh Agent Service Installation via Service Creation (7045)

Flags Windows Event ID 7045 service installations that reference MeshAgent.exe or “Mesh Agent”.

FreeReviewedSigma · Medium · v2
Product
windows
Service
system
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-11-28
Updated
2026-07-31
AnalysisDetection
title: "Windows Service Control Manager: Mesh Agent Service Installation via Service Creation (7045)"
id: ef4c0949-41fa-44f4-8e68-1933527c4ea7
status: test
description: This rule flags Windows Service Control Manager events where a new service is created with an image path containing MeshAgent.exe and a service name containing "Mesh Agent". Attackers can use installed services to persistently run remote management components, making service creation a high-signal indicator for unauthorized deployment. It relies on Windows System service installation telemetry from Event ID 7045, including the service name and image path.
references:
  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_mesh_agent.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-28
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  service: system
detection:
  selection_root:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service:
    - ImagePath|contains: MeshAgent.exe
    - ServiceName|contains: Mesh Agent
  condition: all of selection_*
falsepositives:
  - Legitimate use of the tool
level: medium
license: DRL-1.1
related:
  - id: e0d1ad53-c7eb-48ec-a87a-72393cc6cedc
    type: derived