Sigma rule: Malicious Service Installations

Rule

Title

Malicious Service Installations

Status

unsupported

Level

critical

Author

Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)

Date

2017/03/27

Modified

2022/03/21

File

unsupported/windows/win_mal_service_installs.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.

Log source

product

windows

service

system

Detection

selection:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
malsvc_paexec:
    ImagePath|contains: '\PAExec'
malsvc_wannacry:
    ServiceName: 'mssecsvc2.0'
malsvc_persistence:
    ImagePath|contains: 'net user'
malsvc_apt29:
    ServiceName: 'Java(TM) Virtual Machine Support Service'
condition: selection and 1 of malsvc_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.privilege_escalation
• attack.t1003
• attack.t1035
• attack.t1050
• car.2013-09-005
• attack.t1543.003
• attack.t1569.002

MITRE ATT&CK ids this rule names

• T1003
• T1035
• T1050
• T1543.003
• T1569.002

References

• https://awakesecurity.com/blog/threat-hunting-for-paexec/
• https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html
• https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/unsupported/windows/win_mal_service_installs.yml