huntrule

Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)

Flags Windows service installation or updates for remote access tool services using Service Control Manager events.

FreeReviewedSigma · Medium · v2
Product
windows
Service
system
Author
Connor Martin, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published
2022-12-23
Updated
2026-07-31
AnalysisDetection
title: Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)
id: c6216f09-6090-48d1-ac13-7824da54a2cb
related:
  - id: c8b00925-926c-47e3-beea-298fd563728e
    type: similar
  - id: 1a31b18a-f00c-4061-9900-f735b96c99fc
    type: derived
status: test
description: This rule flags Windows service creation or changes in the Service Control Manager that include service names associated with remote access tools. Attackers often install these services to maintain remote connectivity and persistence on a compromised host. It relies on Windows System logs capturing Service Control Manager events 7045 and 7036 along with matching service name substrings.
references:
  - https://redcanary.com/blog/misbehaving-rats/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_remote_access_software.yml
author: Connor Martin, Nasreddine Bencherchali, Huntrule Team
date: 2022-12-23
modified: 2023-06-22
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1543.003
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID:
      - 7045
      - 7036
    ServiceName|contains:
      - AmmyyAdmin
      - Atera
      - BASupportExpressSrvcUpdater
      - BASupportExpressStandaloneService
      - chromoting
      - GoToAssist
      - GoToMyPC
      - jumpcloud
      - LMIGuardianSvc
      - LogMeIn
      - monblanking
      - Parsec
      - RManService
      - RPCPerformanceService
      - RPCService
      - SplashtopRemoteService
      - SSUService
      - TeamViewer
      - TightVNC
      - vncserver
      - Zoho
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1