Windows System Service Control Manager: cmd /c /r setting variables with -f in ImagePath

title: "Windows System Service Control Manager: cmd /c /r setting variables with -f in ImagePath"
id: 069fbc6b-c17b-4f4a-abee-eb91ce26252d
status: test
description: This rule flags Windows System service installations where the Service Control Manager reports an ImagePath containing cmd.exe usage with /c or /r, a "set" command, and string formatting via -f. Attackers can use Environment Variable and string-formatting tricks to conceal or transform PowerShell-related execution embedded in service startup commands. Telemetry relies on Windows System Service Control Manager event 7045, specifically the ImagePath content.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_var_services.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains|all:
      - cmd
      - '"set'
      - -f
    ImagePath|contains:
      - /c
      - /r
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8ca7004b-e620-4ecb-870e-86129b5b8e75
    type: derived