Suspicious Service was Installed in the System

  1[metadata]
  2creation_date = "2022/08/30"
  3integration = ["system", "windows"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the creation of a new Windows service with a suspicious service name or command value. Windows services
 11typically run as SYSTEM and can be used for privilege escalation and persistence.
 12"""
 13from = "now-9m"
 14index = ["logs-system.security*", "logs-system.system*", "logs-windows.forwarded*", "winlogbeat-*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Suspicious Service was Installed in the System"
 18
 19setup = """## Setup
 20
 21Audit Security System Extension must be enabled to generate the events used by this rule.
 22Setup instructions: https://ela.st/audit-security-system-extension
 23"""
 24
 25risk_score = 47
 26rule_id = "da87eee1-129c-4661-a7aa-57d0b9645fad"
 27severity = "medium"
 28tags = [
 29    "Domain: Endpoint",
 30    "OS: Windows",
 31    "Use Case: Threat Detection",
 32    "Tactic: Persistence",
 33    "Resources: Investigation Guide",
 34    "Data Source: Windows Security Event Logs",
 35    "Data Source: Windows System Event Logs",
 36    "Noise: High",
 37    "Performance: Normal",
 38    "Profile: Aggressive",
 39    "Threat: Ransomware",
 40    "Rule Type: Event Correlation (EQL)",
 41    "Platform: Windows",
 42]
 43timestamp_override = "event.ingested"
 44type = "eql"
 45
 46query = '''
 47any where host.os.type == "windows" and
 48(
 49  (
 50    event.code : "4697" and
 51    (
 52      (
 53        (
 54          winlog.event_data.ServiceFileName : (
 55            "*COMSPEC*", "*\\127.0.0.1*", "*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*",
 56            "*echo*", "*RemComSvc*", "*.bat*", "*.cmd*", "*certutil*", "*vssadmin*", "*certmgr*", "*bitsadmin*",
 57            "*\\Users\\*", "*\\Windows\\Tasks\\*", "*\\PerfLogs\\*", "*\\Windows\\Debug\\*",
 58            "*regsvr32*", "*msbuild*", "*winexesvc.exe*", "*DumpSvc.exe*", "*pwsh.exe*", "*PAExec*"
 59          ) or
 60          winlog.event_data.ServiceFileName regex~ """%systemroot%\\[a-z0-9]+\.exe"""
 61        ) and
 62        not winlog.event_data.ServiceFileName: (
 63              "%SystemRoot%\\PSEXESVC.exe", "C:\\WINDOWS\\PSEXESVC.exe", "%SystemRoot%\\\\RemComSvc.exe",
 64              "%SystemRoot%\\pbpsdeploy.exe", "%SystemRoot%\\system32\\RemComSvc.exe",
 65              "\"C:\\Program Files\\Common Files\\Zoom\\Support\\CptService.exe*",
 66              "\"C:\\Program Files\\Common Files\\ZoomVDIPluginManagement\\Support\\CptService.exe*",
 67              "\"C:\\Program Files (x86)\\Common Files\\Zoom\\Support\\CptService.exe*",
 68              "\"C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\EFR\\host\\cpsechost.exe\" service",
 69              "C:\\Users\\*\\AppData\\Local\\Temp\\VeeamVssSupport\\VeeamGuestHelper.exe*",
 70              "C:\\WINDOWS\\TEMP\\\\TdkLimit64.sys", "C:\\WINDOWS\\TEMP\\\\oraremservicev2\\RemoteExecService.exe"
 71        )
 72      ) or
 73      winlog.event_data.ServiceName : (
 74         "mssecsvc2.0", "WCESERVICE*", "WCE SERVICE*", "pwdump*", "gsecdump*", "cachedump*"
 75      )
 76    )
 77  ) or
 78  (
 79    event.code : "7045" and
 80    (
 81      (
 82        winlog.event_data.ImagePath : (
 83          "*COMSPEC*", "*\\127.0.0.1*", "*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*",
 84          "*echo*", "*.bat*", "*.cmd*", "*certutil*", "*vssadmin*", "*certmgr*", "*bitsadmin*",
 85          "*\\Users\\*", "*\\Windows\\Tasks\\*", "*\\PerfLogs\\*", "*\\Windows\\Debug\\*",
 86          "*regsvr32*", "*msbuild*", "*winexesvc.exe*", "*DumpSvc.exe*", "*pwsh.exe*", "*PAExec*"
 87        ) and
 88        not winlog.event_data.ImagePath : (
 89              "%SystemRoot%\\PSEXESVC.exe", "C:\\WINDOWS\\PSEXESVC.exe", "%SystemRoot%\\\\RemComSvc.exe",
 90              "%SystemRoot%\\pbpsdeploy.exe", "%SystemRoot%\\system32\\RemComSvc.exe",
 91              "\"C:\\Program Files\\Common Files\\Zoom\\Support\\CptService.exe*",
 92              "\"C:\\Program Files\\Common Files\\ZoomVDIPluginManagement\\Support\\CptService.exe*",
 93              "\"C:\\Program Files (x86)\\Common Files\\Zoom\\Support\\CptService.exe*",
 94              "\"C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\EFR\\host\\cpsechost.exe\" service",
 95              "C:\\Users\\*\\AppData\\Local\\Temp\\VeeamVssSupport\\VeeamGuestHelper.exe*",
 96              "C:\\WINDOWS\\TEMP\\\\TdkLimit64.sys", "C:\\WINDOWS\\TEMP\\\\oraremservicev2\\RemoteExecService.exe"
 97        )
 98      ) or
 99      winlog.event_data.ServiceName : (
100         "mssecsvc2.0", "WCESERVICE*", "WCE SERVICE*", "pwdump*", "gsecdump*", "cachedump*"
101      )
102    )
103  )
104) and
105not (
106  winlog.event_data.ServiceName : "cpuz???" and
107  (
108    winlog.event_data.ServiceFileName : ("C:\\WINDOWS\\temp\\cpuz???\\cpuz???_x64.sys", "C:\\Windows\\temp\\cpuz???\\cpuz???_x32.sys") or
109    winlog.event_data.ImagePath : ("C:\\Windows\\temp\\cpuz???\\cpuz???_x64.sys", "C:\\Windows\\temp\\cpuz???\\cpuz???_x32.sys")
110  )
111)
112'''
113
114
115note = """## Triage and analysis
116
117### Investigating Suspicious Service was Installed in the System
118
119#### Possible investigation steps
120
121- What exact service creation event and matched artifact caused the alert?
122  Focus: `event.code`, `host.name`, `winlog.event_data.ServiceName`, `winlog.event_data.ServiceFileName`, `winlog.event_data.ImagePath`.
123  Implication: Event `4697` uses `winlog.event_data.ServiceFileName`; event `7045` uses `winlog.event_data.ImagePath`. Treat malware or credential-dump service names such as `mssecsvc2.0`, `WCESERVICE*`, `WCE SERVICE*`, `pwdump*`, `gsecdump*`, or `cachedump*`, or a command containing PAExec, Winexe, DumpSvc, PowerShell, command shell, admin share, user-writable, or service-control utility traits, as suspicious unless the exact host, service name, command, and alert time map to a validated change record or verified owner confirmation.
124  Review matching service events with $investigate_0
125
126- Do the installing account and service account explain this specific service creation?
127  Focus: `event.code`, `user.name`, `user.domain`, `winlog.logon.id`, `winlog.event_data.ServiceAccount` for event `4697`, and `winlog.event_data.AccountName` for event `7045`.
128  Implication: Event `4697` can identify the installing account and logon session and records the service account in `winlog.event_data.ServiceAccount`. Event `7045` records the service account in `winlog.event_data.AccountName`, but identifying the installer may require recovery of a matching Security event or surrounding service-control and process telemetry. Escalate if the recovered installer identity cannot be tied to the exact service install, if the service runs as a privileged or unexpected account, or if the account context conflicts with the claimed workflow. A benign branch requires recovered evidence that the same account created this same service during a validated maintenance or deployment window on this host. Missing Security or corroborating telemetry remains unresolved.
129  Search recent service install events on the matched host with $investigate_1
130
131- Does the live host still show the same service configuration and referenced artifact?
132  Focus: On the matched `host.id` or `host.name`, retrieve the current service by exact `winlog.event_data.ServiceName` with `sc.exe qc`, `sc.exe queryex`, or `Get-CimInstance Win32_Service -Filter Name='<service name>'`; record the service path, account, status, and start context, then inspect the referenced executable or script on disk when it is still present.
133  Implication: Live service configuration can confirm current path, account, status, and start context, but configuration alone does not prove the service command executed. Escalate when the current service or referenced artifact supports persistence, or when process telemetry, service-control logs, or other execution events show the service command ran. If live-host retrieval or artifact inspection is unavailable, the unavailable live-host evidence remains unresolved. A benign branch requires the live or recovered service state to match the exact expected service lifecycle, such as a short-lived remote support service removed after the named deployment task, without extra commands or altered paths.
134
135- Are there corroborating process, file, registry, or authentication events on the same host around the service installation?
136  Focus: `host.id`, `winlog.event_data.ServiceName`, `winlog.event_data.ServiceAccount` for event `4697`, `winlog.event_data.AccountName` for event `7045`, `user.name`, and `winlog.record_id`.
137  Implication: Process, file, registry, and service-control telemetry are supporting sources and may be absent from the final alert; recover them manually by host and time before drawing conclusions. Escalate if recovered events show the service launching shell, LOLBin, credential-dumping, or user-writable path payloads. If those supporting sources are missing, keep the case unresolved instead of treating absence as benign.
138
139- If local evidence is suspicious or unresolved, has the same service name appeared on other hosts?
140  Focus: `winlog.event_data.ServiceName`, `host.name`, `winlog.event_data.ServiceFileName`, `winlog.event_data.ImagePath`, `user.name`.
141  Implication: Use this only after the local service and artifact checks above. Reuse across hosts supports a lateral movement, remote administration, or shared deployment hypothesis; scope containment and account review to matching hosts when the service name or installer context is suspicious. A benign branch requires recovered events on the additional hosts to share the same deployment window, installing account when available, and exact service command for one validated change record. Absence of related alerts does not prove benign.
142  Pivot on the service name across hosts with $investigate_2
143
144Disposition: Escalate suspicious service commands, mismatched installer or service-account context, persistent live service state, or repeated hosts; close only when alert-local fields plus recovered service and host evidence prove the exact expected workflow; preserve and escalate mixed or incomplete cases for more context before final disposition.
145
146### False positive analysis
147
148- Remote administration and deployment tools such as PAExec, RemCom, and Winexe can create temporary services that match the suspicious service-name or command patterns. Close only when the recovered `winlog.event_data.ServiceName`, command field, installing account, target host, and timing all match one validated maintenance or deployment action.
149- PowerShell, `pwsh.exe`, `cmd.exe`, `rundll32`, `regsvr32`, `msbuild`, `bitsadmin`, `certutil`, or `vssadmin` in a service command should remain suspicious until the referenced script or command content, service account, and owner confirmation explain the exact alert artifact on this host.
150- Scope exceptions to durable alert fields. For event `4697`, use exact `winlog.event_data.ServiceName` and `winlog.event_data.ServiceFileName`; for event `7045`, use exact `winlog.event_data.ServiceName` and `winlog.event_data.ImagePath`. Add `host.id` or `host.name`, plus `user.name` and `user.domain`, when those fields repeat in the validated benign pattern.
151
152### Response and remediation
153
154- Collect and preserve case evidence, export the alert and matched service event, and preserve volatile process, memory, executable, script, service configuration, and file-system artifacts that could be lost before isolation, process termination, service removal, cleanup, or other disruptive action.
155- Review recovered evidence and scope affected hosts/accounts by service name, service command, installing account, target host, and related authentication before containment decisions.
156- If malicious service execution is confirmed, use the endpoint response integration as the preferred path to isolate affected hosts, and disable exposed accounts as reversible containment while retaining evidence. When direct response is unavailable, document handoff to the responsible incident-response or endpoint-operations owner for host isolation and to the identity owner for account containment.
157- After scoping and preservation, stop malicious service processes if running, remove the malicious service or persistence entry, quarantine associated executable or script files, and run an antimalware scan.
158- Reset or rotate credentials for accounts that installed, ran, or were accessed by the malicious service after credential exposure review.
159- Record confirmed service names, commands, recovered file hashes, installing accounts, affected hosts, and telemetry or detection gaps for responsible detection and logging owners after scoping and containment.
160"""
161[rule.investigation_fields]
162field_names = [
163    "@timestamp",
164    "host.id",
165    "host.name",
166    "event.code",
167    "winlog.event_data.ServiceName",
168    "winlog.event_data.ServiceFileName",
169    "winlog.event_data.ImagePath",
170    "winlog.event_data.ServiceAccount",
171    "winlog.event_data.AccountName",
172    "winlog.event_data.ServiceStartType",
173    "winlog.event_data.StartType",
174    "user.id",
175    "user.name",
176    "user.domain",
177]
178
179
180[[transform.investigate]]
181label = "Matched service on host"
182description = ""
183providers = [
184    [
185        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
186        { excluded = false, field = "winlog.event_data.ServiceName", queryType = "phrase", value = "{{winlog.event_data.ServiceName}}", valueType = "string" },
187        { excluded = false, field = "event.code", queryType = "phrase", value = "4697", valueType = "string" },
188    ],
189    [
190        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
191        { excluded = false, field = "winlog.event_data.ServiceName", queryType = "phrase", value = "{{winlog.event_data.ServiceName}}", valueType = "string" },
192        { excluded = false, field = "event.code", queryType = "phrase", value = "7045", valueType = "string" },
193    ],
194]
195relativeFrom = "now-24h/h"
196relativeTo = "now"
197
198[[transform.investigate]]
199label = "Recent service installs on host"
200description = ""
201providers = [
202    [
203        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
204        { excluded = false, field = "event.code", queryType = "phrase", value = "4697", valueType = "string" },
205    ],
206    [
207        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
208        { excluded = false, field = "event.code", queryType = "phrase", value = "7045", valueType = "string" },
209    ],
210]
211relativeFrom = "now-48h/h"
212relativeTo = "now"
213
214[[transform.investigate]]
215label = "Same service name across hosts"
216description = ""
217providers = [
218    [
219        { excluded = false, field = "winlog.event_data.ServiceName", queryType = "phrase", value = "{{winlog.event_data.ServiceName}}", valueType = "string" },
220        { excluded = false, field = "event.code", queryType = "phrase", value = "4697", valueType = "string" },
221    ],
222    [
223        { excluded = false, field = "winlog.event_data.ServiceName", queryType = "phrase", value = "{{winlog.event_data.ServiceName}}", valueType = "string" },
224        { excluded = false, field = "event.code", queryType = "phrase", value = "7045", valueType = "string" },
225    ],
226]
227relativeFrom = "now-48h/h"
228relativeTo = "now"
229[[rule.threat]]
230framework = "MITRE ATT&CK"
231[[rule.threat.technique]]
232id = "T1543"
233name = "Create or Modify System Process"
234reference = "https://attack.mitre.org/techniques/T1543/"
235[[rule.threat.technique.subtechnique]]
236id = "T1543.003"
237name = "Windows Service"
238reference = "https://attack.mitre.org/techniques/T1543/003/"
239
240
241
242[rule.threat.tactic]
243id = "TA0003"
244name = "Persistence"
245reference = "https://attack.mitre.org/tactics/TA0003/"
246
247[[rule.threat]]
248framework = "MITRE ATT&CK"
249
250[[rule.threat.technique]]
251id = "T1569"
252name = "System Services"
253reference = "https://attack.mitre.org/techniques/T1569/"
254
255[[rule.threat.technique.subtechnique]]
256id = "T1569.002"
257name = "Service Execution"
258reference = "https://attack.mitre.org/techniques/T1569/002/"
259
260[rule.threat.tactic]
261id = "TA0002"
262name = "Execution"
263reference = "https://attack.mitre.org/tactics/TA0002/"