huntrule

Windows Service Installation Referencing Suspicious ProgramData/Root EXE Paths (Event 7045)

Flags Windows service installs (Event 7045) that reference suspicious EXE paths in ProgramData or directly under C:\.

FreeUnreviewedSigmahighv1
title: Windows Service Installation Referencing Suspicious ProgramData/Root EXE Paths (Event 7045)
id: fd37403b-2202-475d-8906-3d8b8ebd3130
status: test
description: This rule identifies Windows service creation events where the Service Control Manager reports an ImagePath that matches suspicious executable placement patterns under ProgramData or directly under the C:\ root. Attackers may use this to establish persistence or privilege escalation by executing a service binary from atypical locations. It relies on Windows system service installation telemetry (EventID 7045) and the ImagePath field reported by the Service Control Manager.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder_pattern.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-03-18
modified: 2022-03-24
tags:
  - attack.persistence
  - attack.privilege-escalation
  - car.2013-09-005
  - attack.t1543.003
logsource:
  product: windows
  service: system
detection:
  selection_eid:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_img_paths:
    - ImagePath|re: ^[Cc]:\\[Pp]rogram[Dd]ata\\.{1,9}\.exe
    - ImagePath|re: ^[Cc]:\\.{1,9}\.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1b2ae822-6fe1-43ba-aa7c-d1a3b3d1d5f2
    type: derived

What it detects

This rule identifies Windows service creation events where the Service Control Manager reports an ImagePath that matches suspicious executable placement patterns under ProgramData or directly under the C:\ root. Attackers may use this to establish persistence or privilege escalation by executing a service binary from atypical locations. It relies on Windows system service installation telemetry (EventID 7045) and the ImagePath field reported by the Service Control Manager.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.