huntrule

Windows Service Installation Using Script Host Execution (Event ID 7045)

Identifies suspicious Windows service installations that embed script host execution via Event ID 7045 ImagePath patterns.

FreeUnreviewedSigmahighv1
title: Windows Service Installation Using Script Host Execution (Event ID 7045)
id: 14915478-da3c-4a01-ba8f-6e284985de38
status: test
description: This rule flags Windows Service Control Manager events (Event ID 7045) where a newly installed service points to an ImagePath containing script host or scripting binaries such as cscript, mshta, PowerShell/pwsh, regsvr32, rundll32, or wscript. It further narrows matches to command-line patterns commonly used to execute or register payloads via service start parameters (e.g., including " -c ", " -r ", or " -k "). This matters because attackers can abuse service creation to achieve persistence or privilege escalation, and the rule relies on Windows service installation telemetry including Provider_Name and ImagePath content.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_susp_service_installation_script.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-03-18
modified: 2024-03-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - car.2013-09-005
  - attack.t1543.003
logsource:
  product: windows
  service: system
detection:
  selection_eid:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_cmd_flags:
    ImagePath|contains|windash:
      - " -c "
      - " -r "
      - " -k "
  selection_binaries:
    ImagePath|contains:
      - cscript
      - mshta
      - powershell
      - pwsh
      - regsvr32
      - rundll32
      - wscript
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 70f00d10-60b2-4f34-b9a0-dc3df3fe762a
    type: derived

What it detects

This rule flags Windows Service Control Manager events (Event ID 7045) where a newly installed service points to an ImagePath containing script host or scripting binaries such as cscript, mshta, PowerShell/pwsh, regsvr32, rundll32, or wscript. It further narrows matches to command-line patterns commonly used to execute or register payloads via service start parameters (e.g., including " -c ", " -r ", or " -k "). This matters because attackers can abuse service creation to achieve persistence or privilege escalation, and the rule relies on Windows service installation telemetry including Provider_Name and ImagePath content.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.