Sigma rule: Suspicious Service Installed

Rule

Title

Suspicious Service Installed

Status

test

Level

medium

Author

xknow (@xknow_infosec), xorxes (@xor_xes)

Date

2019-04-08

Modified

2026-06-29

File

rules/windows/registry/registry_set/registry_set_susp_service_installed.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders.
Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject:
        - 'HKLM\System\CurrentControlSet\Services\NalDrv\ImagePath'
        - 'HKLM\System\CurrentControlSet\Services\PROCEXP152\ImagePath'
filter:
    Image|endswith:
        # Please add the full paths that you use in your environment to tighten the rule
        - '\procexp64.exe'
        - '\procexp64a.exe'
        - '\procexp.exe'
        - '\procmon64.exe'
        - '\procmon64a.exe'
        - '\procmon.exe'
        - '\handle.exe'
        - '\handle64.exe'
        - '\handle64a.exe'
    Details|contains: '\WINDOWS\system32\Drivers\PROCEXP152.SYS'
condition: selection and not filter

False positives (as the rule lists them)

• Other legimate tools using this service names and drivers. Note - clever attackers may easily bypass this detection by just renaming the services. Therefore just Medium-level and don't rely on it.

Tags

• attack.defense-impairment
• attack.t1685

MITRE ATT&CK ids this rule names

• T1685

References

• https://web.archive.org/web/20200419024230/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_susp_service_installed.yml