huntrule

Windows System Service Control Manager Detects VAR++ Obfuscated PowerShell in Service ImagePath

Flags newly created Windows services whose ImagePath contains cmd chaining and obfuscated PowerShell launcher indicators.

FreeUnreviewedSigmahighv1
title: Windows System Service Control Manager Detects VAR++ Obfuscated PowerShell in Service ImagePath
id: f1455476-060e-4648-a0e6-20b2945f0e6d
status: test
description: This rule identifies Windows Service Control Manager (Event ID 7045) where a new service is created with an ImagePath containing command-shell chaining tokens and encoded/variable-driven PowerShell components consistent with VAR++ launcher obfuscation. Attackers use this pattern to conceal malicious PowerShell execution inside service installation, increasing stealth at the time of service creation. It relies on System service creation telemetry and the ImagePath string captured in the Service Control Manager event.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_var_services.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains|all:
      - "&&set"
      - cmd
      - /c
      - -f
    ImagePath|contains:
      - "{0}"
      - "{1}"
      - "{2}"
      - "{3}"
      - "{4}"
      - "{5}"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 14bcba49-a428-42d9-b943-e2ce0f0f7ae6
    type: derived

What it detects

This rule identifies Windows Service Control Manager (Event ID 7045) where a new service is created with an ImagePath containing command-shell chaining tokens and encoded/variable-driven PowerShell components consistent with VAR++ launcher obfuscation. Attackers use this pattern to conceal malicious PowerShell execution inside service installation, increasing stealth at the time of service creation. It relies on System service creation telemetry and the ImagePath string captured in the Service Control Manager event.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.