Windows System Service Creates cmd Launching PowerShell with stdin Obfuscation

Flags SCM-created services whose ImagePath runs cmd to invoke PowerShell using stdin/input and -NoExit patterns.

FreeUnreviewedSigmahighv1

windows-system-service-creates-cmd-launching-powershell-with-stdin-obfuscation-72862bf2

title: Windows System Service Creates cmd Launching PowerShell with stdin Obfuscation
id: 97495202-e8a5-4412-9295-f781af9ac1dd
status: test
description: This rule identifies Service Control Manager (SCM) events where the service ImagePath includes cmd invoking PowerShell with patterns consistent with reading from stdin (e.g., input/$) and using obfuscation-like syntax (such as -NoExit). Attackers may use this technique to execute PowerShell payloads indirectly through redirected input to evade inspection and hinder analysis. The detection relies on Windows System telemetry from SCM service creation events (Event ID 7045) and string matches within the recorded ImagePath.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_stdin_services.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: system
detection:
  selection_main:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains|all:
      - cmd
      - powershell
    ImagePath|contains:
      - /c
      - /r
  selection_other:
    - ImagePath|contains: noexit
    - ImagePath|contains|all:
        - input
        - $
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 72862bf2-0eb1-11eb-adc1-0242ac120002
    type: derived

What it detects

This rule identifies Service Control Manager (SCM) events where the service ImagePath includes cmd invoking PowerShell with patterns consistent with reading from stdin (e.g., input/$) and using obfuscation-like syntax (such as -NoExit). Attackers may use this technique to execute PowerShell payloads indirectly through redirected input to evade inspection and hinder analysis. The detection relies on Windows System telemetry from SCM service creation events (Event ID 7045) and string matches within the recorded ImagePath.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.