huntrule

Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)

Flags Windows service installation or updates for remote access tool services using Service Control Manager events.

FreeReviewedSigma · Medium · v2
Product
windows
Service
system
Author
Connor Martin, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published
2022-12-23
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows service creation or changes in the Service Control Manager that include service names associated with remote access tools. Attackers often install these services to maintain remote connectivity and persistence on a compromised host. It relies on Windows System logs capturing Service Control Manager events 7045 and 7036 along with matching service name substrings.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange
Windows Security Event 4697 Service Install of Remote Access Tools
Windows Service Control Manager detects Sliver C2 default service installations via service creation events
Windows Registry Service Install Indicators for Cobalt Strike Staging
Windows Service Control Manager: ProcessHacker service runs as LocalSystem
Windows Service Control Manager Events: Suspicious Service Install Paths used by Cobalt Strike
Windows Security 4697 Alerts for Service Installations Using Cobalt Strike Beacon Payloads
Windows Service Creation: ServiceName javamtsup (Event ID 4697)
Malicious Service DLL Hijack for Persistence via Lotus Blossom
Malicious TinyTurla ServiceDll Registration via svchost Group (via registry_set)
Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)
Pivot detection · T1543.003 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.