Windows System Service Creation of Obfuscated PowerShell Using COMPRESS OBFUSCATION

Flags new Windows services whose ImagePath includes obfuscated PowerShell markers using COMPRESS/stream decompression.

FreeUnreviewedSigmamediumv1

windows-system-service-creation-of-obfuscated-powershell-using-compress-obfuscat-175997c5

title: Windows System Service Creation of Obfuscated PowerShell Using COMPRESS OBFUSCATION
id: 804e82d2-4506-4458-a3aa-bc6d43391d6f
status: test
description: This rule identifies creation of a new Windows service (Service Control Manager EventID 7045) where the service ImagePath contains PowerShell obfuscation indicators. It specifically looks for PowerShell constructs alongside ASCII encoding and stream decompression/compression classes, which are commonly used to hide malicious commands from casual inspection. Detection relies on System log telemetry from Service Control Manager that records the configured ImagePath for newly created services.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_compress_services.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains|all:
      - new-object
      - text.encoding]::ascii
      - readtoend
    ImagePath|contains:
      - :system.io.compression.deflatestream
      - system.io.streamreader
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 175997c5-803c-4b08-8bb0-70b099f47595
    type: derived

What it detects

This rule identifies creation of a new Windows service (Service Control Manager EventID 7045) where the service ImagePath contains PowerShell obfuscation indicators. It specifically looks for PowerShell constructs alongside ASCII encoding and stream decompression/compression classes, which are commonly used to hide malicious commands from casual inspection. Detection relies on System log telemetry from Service Control Manager that records the configured ImagePath for newly created services.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.