Windows System Service Installation of Remote Access Tools

title: Windows System Service Installation of Remote Access Tools
id: c6216f09-6090-48d1-ac13-7824da54a2cb
related:
  - id: c8b00925-926c-47e3-beea-298fd563728e
    type: similar
  - id: 1a31b18a-f00c-4061-9900-f735b96c99fc
    type: derived
status: test
description: This rule identifies Windows service creation or state changes for services associated with multiple remote access tools by matching the Service Control Manager provider and specific service management event IDs. Attackers may abuse remote access software to establish persistent remote connectivity and maintain control of a compromised host. The detection relies on Windows System log events from the Service Control Manager and uses ServiceName substring matching for known remote access tool service names.
references:
  - https://redcanary.com/blog/misbehaving-rats/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_remote_access_software.yml
author: Connor Martin, Nasreddine Bencherchali, Huntrule Team
date: 2022-12-23
modified: 2023-06-22
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1543.003
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID:
      - 7045
      - 7036
    ServiceName|contains:
      - AmmyyAdmin
      - Atera
      - BASupportExpressSrvcUpdater
      - BASupportExpressStandaloneService
      - chromoting
      - GoToAssist
      - GoToMyPC
      - jumpcloud
      - LMIGuardianSvc
      - LogMeIn
      - monblanking
      - Parsec
      - RManService
      - RPCPerformanceService
      - RPCService
      - SplashtopRemoteService
      - SSUService
      - TeamViewer
      - TightVNC
      - vncserver
      - Zoho
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1