Sigma rule: Meterpreter or Cobalt Strike Getsystem Service Installation - Security

Rule

Title

Meterpreter or Cobalt Strike Getsystem Service Installation - Security

Status

test

Level

high

Author

Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)

Date

2019-10-26

Modified

2023-11-15

File

rules/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Log source

product

windows

service

security

definition

The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697

Detection

selection_eid:
    EventID: 4697
selection_cli_cmd:
    # meterpreter getsystem technique 1: cmd.exe /c echo 559891bb017 > \\.\pipe\5e120a
    # cobaltstrike getsystem technique 1: %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
    # cobaltstrike getsystem technique 1b (expanded %COMSPEC%): %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
    ServiceFileName|contains|all:
        - '/c'
        - 'echo'
        - '\pipe\'
    ServiceFileName|contains:
        - 'cmd'
        - '%COMSPEC%'
selection_cli_rundll:
    # meterpreter getsystem technique 2: rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn
    ServiceFileName|contains|all:
        - 'rundll32'
        - '.dll,a'
        - '/p:'
selection_cli_share:
    ServiceFileName|startswith: '\\\\127.0.0.1\\ADMIN$\'  # https://twitter.com/svch0st/status/1413688851877416960?lang=en
condition: selection_eid and 1 of selection_cli_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1134.001
• attack.t1134.002

MITRE ATT&CK ids this rule names

• T1134.001
• T1134.002

Related rules

• 843544a7-56e0-4dcc-a44f-5cc266dd97d6 (derived)

References

• https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
• https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml