Sigma rule: Meterpreter or Cobalt Strike Getsystem Service Installation - System

Rule

Title

Meterpreter or Cobalt Strike Getsystem Service Installation - System

Status

test

Level

high

Author

Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)

Date

2019-10-26

Modified

2023-11-15

File

rules/windows/builtin/system/service_control_manager/win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Log source

product

windows

service

system

Detection

selection_id:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
selection_cli_cmd:
    # meterpreter getsystem technique 1: cmd.exe /c echo 559891bb017 > \\.\pipe\5e120a
    # cobaltstrike getsystem technique 1: %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
    # cobaltstrike getsystem technique 1b (expanded %COMSPEC%): %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
    ImagePath|contains|all:
        - '/c'
        - 'echo'
        - '\pipe\'
    ImagePath|contains:
    - 'cmd'
    - '%COMSPEC%'
selection_cli_rundll:
    # meterpreter getsystem technique 2: rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn
    ImagePath|contains|all:
        - 'rundll32'
        - '.dll,a'
        - '/p:'
selection_cli_share:
    ImagePath|startswith: '\\\\127.0.0.1\\ADMIN$\'  # https://twitter.com/svch0st/status/1413688851877416960?lang=en
condition: selection_id and 1 of selection_cli_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1134.001
• attack.t1134.002

MITRE ATT&CK ids this rule names

• T1134.001
• T1134.002

References

• https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
• https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/system/service_control_manager/win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml