Windows System: Service Control Manager launches cmd with obfuscated clip.exe to run PowerShell

title: "Windows System: Service Control Manager launches cmd with obfuscated clip.exe to run PowerShell"
id: 22b58464-129c-4a9c-bf84-843673dd15ac
status: test
description: This rule identifies Windows Service Control Manager (Event ID 7045) creating a service whose ImagePath contains command chaining and clipboard-related PowerShell invocation patterns involving clip.exe ("clipboard]::"). Such behavior matters because attackers can hide execution logic behind obfuscated command lines launched as services to run PowerShell indirectly. The detection relies on System service-install telemetry, specifically the ImagePath content reported in Event ID 7045.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_clip_services.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2023-02-20
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains|all:
      - cmd
      - "&&"
      - "clipboard]::"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f7385ee2-0e0c-11eb-adc1-0242ac120002
    type: derived