Windows System Event 7045: Service Control Manager runs ImagePath with Invoke/Environment stdin obfuscation

title: "Windows System Event 7045: Service Control Manager runs ImagePath with Invoke/Environment stdin obfuscation"
id: 835e04a3-3c28-48a5-8835-d540fe2f7927
status: test
description: This rule flags Windows service creation events (System, EventID 7045) where the Service Control Manager registers a service whose ImagePath contains command chaining tokens ('set' and '&&') along with strings related to environment manipulation, invoking commands, or input usage. Attackers may use obfuscated PowerShell-style execution patterns embedded in a service ImagePath to evade straightforward inspection while running code at service start. Detection relies on System event telemetry (Provider_Name 'Service Control Manager' and EventID 7045) and string matches within the service ImagePath.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_stdin_services.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-12
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains|all:
      - set
      - "&&"
    ImagePath|contains:
      - environment
      - invoke
      - input
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 487c7524-f892-4054-b263-8a0ace63fc25
    type: derived