Windows Service Installed by System Process with PID 0

title: Windows Service Installed by System Process with PID 0
id: bfe0643e-0592-4d61-a5e1-4549c706a011
related:
  - id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca
    type: similar
  - id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5
    type: derived
status: test
description: This rule flags Windows Service Control Manager events where a service installation occurs with a ProcessId of 0, indicating the installing client process is anomalous. Attackers may use unusual execution contexts to persist or escalate privileges by registering new services. The detection relies on Windows service installation telemetry from Service Control Manager (EventID 7045) with a ProcessId of 0.
references:
  - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_sups_unusal_client.yml
author: Tim Rauch (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-09-15
modified: 2023-01-04
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ProcessId: 0
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1