Suspicious Service was Installed in the System

  1[metadata]
  2creation_date = "2022/08/30"
  3integration = ["system", "windows"]
  4maturity = "production"
  5updated_date = "2026/07/29"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the creation of a new Windows service with a suspicious service name or command value. Windows services
 11typically run as SYSTEM and can be used for privilege escalation and persistence.
 12"""
 13from = "now-9m"
 14index = ["logs-system.security*", "logs-system.system*", "logs-windows.forwarded*", "winlogbeat-*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Suspicious Service was Installed in the System"
 18
 19setup = """## Setup
 20
 21Audit Security System Extension must be enabled to generate the events used by this rule.
 22Setup instructions: https://ela.st/audit-security-system-extension
 23"""
 24
 25risk_score = 47
 26rule_id = "da87eee1-129c-4661-a7aa-57d0b9645fad"
 27severity = "medium"
 28tags = [
 29    "Domain: Endpoint",
 30    "OS: Windows",
 31    "Use Case: Threat Detection",
 32    "Tactic: Persistence",
 33    "Resources: Investigation Guide",
 34    "Data Source: Windows Security Event Logs",
 35    "Data Source: Windows System Event Logs",
 36]
 37timestamp_override = "event.ingested"
 38type = "eql"
 39
 40query = '''
 41any where host.os.type == "windows" and
 42(
 43  (
 44    event.code : "4697" and
 45    (
 46      (
 47        (
 48          winlog.event_data.ServiceFileName : (
 49            "*COMSPEC*", "*\\127.0.0.1*", "*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*",
 50            "*echo*", "*RemComSvc*", "*.bat*", "*.cmd*", "*certutil*", "*vssadmin*", "*certmgr*", "*bitsadmin*",
 51            "*\\Users\\*", "*\\Windows\\Tasks\\*", "*\\PerfLogs\\*", "*\\Windows\\Debug\\*",
 52            "*regsvr32*", "*msbuild*", "*winexesvc.exe*", "*DumpSvc.exe*", "*pwsh.exe*", "*PAExec*"
 53          ) or
 54          winlog.event_data.ServiceFileName regex~ """%systemroot%\\[a-z0-9]+\.exe"""
 55        ) and
 56        not winlog.event_data.ServiceFileName: (
 57              "%SystemRoot%\\PSEXESVC.exe", "%SystemRoot%\\\\RemComSvc.exe",
 58              "%SystemRoot%\\pbpsdeploy.exe", "%SystemRoot%\\system32\\RemComSvc.exe",
 59              "\"C:\\Program Files\\Common Files\\Zoom\\Support\\CptService.exe*",
 60              "\"C:\\Program Files\\Common Files\\ZoomVDIPluginManagement\\Support\\CptService.exe*",
 61              "\"C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\EFR\\host\\cpsechost.exe\" service"
 62        )
 63      ) or
 64      winlog.event_data.ServiceName : (
 65         "mssecsvc2.0", "WCESERVICE*", "WCE SERVICE*", "pwdump*", "gsecdump*", "cachedump*"
 66      )
 67    )
 68  ) or
 69  (
 70    event.code : "7045" and
 71    (
 72      (
 73        winlog.event_data.ImagePath : (
 74          "*COMSPEC*", "*\\127.0.0.1*", "*Admin$*", "*powershell*", "*rundll32*", "*cmd.exe*",
 75          "*echo*", "*.bat*", "*.cmd*", "*certutil*", "*vssadmin*", "*certmgr*", "*bitsadmin*",
 76          "*\\Users\\*", "*\\Windows\\Tasks\\*", "*\\PerfLogs\\*", "*\\Windows\\Debug\\*",
 77          "*regsvr32*", "*msbuild*", "*winexesvc.exe*", "*DumpSvc.exe*", "*pwsh.exe*", "*PAExec*"
 78        ) and
 79        not winlog.event_data.ImagePath : (
 80              "%SystemRoot%\\PSEXESVC.exe", "%SystemRoot%\\\\RemComSvc.exe",
 81              "%SystemRoot%\\pbpsdeploy.exe", "%SystemRoot%\\system32\\RemComSvc.exe",
 82              "\"C:\\Program Files\\Common Files\\Zoom\\Support\\CptService.exe*",
 83              "\"C:\\Program Files\\Common Files\\ZoomVDIPluginManagement\\Support\\CptService.exe*",
 84              "\"C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\EFR\\host\\cpsechost.exe\" service"
 85        )
 86      ) or
 87      winlog.event_data.ServiceName : (
 88         "mssecsvc2.0", "WCESERVICE*", "WCE SERVICE*", "pwdump*", "gsecdump*", "cachedump*"
 89      )
 90    )
 91  )
 92)
 93'''
 94
 95
 96note = """## Triage and analysis
 97
 98### Investigating Suspicious Service was Installed in the System
 99
100#### Possible investigation steps
101
102- What exact service creation event and matched artifact caused the alert?
103  Focus: `event.code`, `host.name`, `winlog.event_data.ServiceName`, `winlog.event_data.ServiceFileName`, `winlog.event_data.ImagePath`.
104  Implication: Event `4697` uses `winlog.event_data.ServiceFileName`; event `7045` uses `winlog.event_data.ImagePath`. Treat malware or credential-dump service names such as `mssecsvc2.0`, `WCESERVICE*`, `WCE SERVICE*`, `pwdump*`, `gsecdump*`, or `cachedump*`, or a command containing PAExec, Winexe, DumpSvc, PowerShell, command shell, admin share, user-writable, or service-control utility traits, as suspicious unless the exact host, service name, command, and alert time map to a validated change record or verified owner confirmation.
105  Review matching service events with $investigate_0
106
107- Do the installing account and service account explain this specific service creation?
108  Focus: `event.code`, `user.name`, `user.domain`, `winlog.logon.id`, `winlog.event_data.ServiceAccount` for event `4697`, and `winlog.event_data.AccountName` for event `7045`.
109  Implication: Event `4697` can identify the installing account and logon session and records the service account in `winlog.event_data.ServiceAccount`. Event `7045` records the service account in `winlog.event_data.AccountName`, but identifying the installer may require recovery of a matching Security event or surrounding service-control and process telemetry. Escalate if the recovered installer identity cannot be tied to the exact service install, if the service runs as a privileged or unexpected account, or if the account context conflicts with the claimed workflow. A benign branch requires recovered evidence that the same account created this same service during a validated maintenance or deployment window on this host. Missing Security or corroborating telemetry remains unresolved.
110  Search recent service install events on the matched host with $investigate_1
111
112- Does the live host still show the same service configuration and referenced artifact?
113  Focus: On the matched `host.id` or `host.name`, retrieve the current service by exact `winlog.event_data.ServiceName` with `sc.exe qc`, `sc.exe queryex`, or `Get-CimInstance Win32_Service -Filter Name='<service name>'`; record the service path, account, status, and start context, then inspect the referenced executable or script on disk when it is still present.
114  Implication: Live service configuration can confirm current path, account, status, and start context, but configuration alone does not prove the service command executed. Escalate when the current service or referenced artifact supports persistence, or when process telemetry, service-control logs, or other execution events show the service command ran. If live-host retrieval or artifact inspection is unavailable, the unavailable live-host evidence remains unresolved. A benign branch requires the live or recovered service state to match the exact expected service lifecycle, such as a short-lived remote support service removed after the named deployment task, without extra commands or altered paths.
115
116- Are there corroborating process, file, registry, or authentication events on the same host around the service installation?
117  Focus: `host.id`, `winlog.event_data.ServiceName`, `winlog.event_data.ServiceAccount` for event `4697`, `winlog.event_data.AccountName` for event `7045`, `user.name`, and `winlog.record_id`.
118  Implication: Process, file, registry, and service-control telemetry are supporting sources and may be absent from the final alert; recover them manually by host and time before drawing conclusions. Escalate if recovered events show the service launching shell, LOLBin, credential-dumping, or user-writable path payloads. If those supporting sources are missing, keep the case unresolved instead of treating absence as benign.
119
120- If local evidence is suspicious or unresolved, has the same service name appeared on other hosts?
121  Focus: `winlog.event_data.ServiceName`, `host.name`, `winlog.event_data.ServiceFileName`, `winlog.event_data.ImagePath`, `user.name`.
122  Implication: Use this only after the local service and artifact checks above. Reuse across hosts supports a lateral movement, remote administration, or shared deployment hypothesis; scope containment and account review to matching hosts when the service name or installer context is suspicious. A benign branch requires recovered events on the additional hosts to share the same deployment window, installing account when available, and exact service command for one validated change record. Absence of related alerts does not prove benign.
123  Pivot on the service name across hosts with $investigate_2
124
125Disposition: Escalate suspicious service commands, mismatched installer or service-account context, persistent live service state, or repeated hosts; close only when alert-local fields plus recovered service and host evidence prove the exact expected workflow; preserve and escalate mixed or incomplete cases for more context before final disposition.
126
127### False positive analysis
128
129- Remote administration and deployment tools such as PAExec, RemCom, and Winexe can create temporary services that match the suspicious service-name or command patterns. Close only when the recovered `winlog.event_data.ServiceName`, command field, installing account, target host, and timing all match one validated maintenance or deployment action.
130- PowerShell, `pwsh.exe`, `cmd.exe`, `rundll32`, `regsvr32`, `msbuild`, `bitsadmin`, `certutil`, or `vssadmin` in a service command should remain suspicious until the referenced script or command content, service account, and owner confirmation explain the exact alert artifact on this host.
131- Scope exceptions to durable alert fields. For event `4697`, use exact `winlog.event_data.ServiceName` and `winlog.event_data.ServiceFileName`; for event `7045`, use exact `winlog.event_data.ServiceName` and `winlog.event_data.ImagePath`. Add `host.id` or `host.name`, plus `user.name` and `user.domain`, when those fields repeat in the validated benign pattern.
132
133### Response and remediation
134
135- Collect and preserve case evidence, export the alert and matched service event, and preserve volatile process, memory, executable, script, service configuration, and file-system artifacts that could be lost before isolation, process termination, service removal, cleanup, or other disruptive action.
136- Review recovered evidence and scope affected hosts/accounts by service name, service command, installing account, target host, and related authentication before containment decisions.
137- If malicious service execution is confirmed, use the endpoint response integration as the preferred path to isolate affected hosts, and disable exposed accounts as reversible containment while retaining evidence. When direct response is unavailable, document handoff to the responsible incident-response or endpoint-operations owner for host isolation and to the identity owner for account containment.
138- After scoping and preservation, stop malicious service processes if running, remove the malicious service or persistence entry, quarantine associated executable or script files, and run an antimalware scan.
139- Reset or rotate credentials for accounts that installed, ran, or were accessed by the malicious service after credential exposure review.
140- Record confirmed service names, commands, recovered file hashes, installing accounts, affected hosts, and telemetry or detection gaps for responsible detection and logging owners after scoping and containment.
141"""
142[rule.investigation_fields]
143field_names = [
144    "@timestamp",
145    "host.id",
146    "host.name",
147    "event.code",
148    "winlog.event_data.ServiceName",
149    "winlog.event_data.ServiceFileName",
150    "winlog.event_data.ImagePath",
151    "winlog.event_data.ServiceAccount",
152    "winlog.event_data.AccountName",
153    "winlog.event_data.ServiceStartType",
154    "winlog.event_data.StartType",
155    "user.id",
156    "user.name",
157    "user.domain",
158]
159
160
161[[transform.investigate]]
162label = "Matched service on host"
163description = ""
164providers = [
165    [
166        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
167        { excluded = false, field = "winlog.event_data.ServiceName", queryType = "phrase", value = "{{winlog.event_data.ServiceName}}", valueType = "string" },
168        { excluded = false, field = "event.code", queryType = "phrase", value = "4697", valueType = "string" },
169    ],
170    [
171        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
172        { excluded = false, field = "winlog.event_data.ServiceName", queryType = "phrase", value = "{{winlog.event_data.ServiceName}}", valueType = "string" },
173        { excluded = false, field = "event.code", queryType = "phrase", value = "7045", valueType = "string" },
174    ],
175]
176relativeFrom = "now-24h/h"
177relativeTo = "now"
178
179[[transform.investigate]]
180label = "Recent service installs on host"
181description = ""
182providers = [
183    [
184        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
185        { excluded = false, field = "event.code", queryType = "phrase", value = "4697", valueType = "string" },
186    ],
187    [
188        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
189        { excluded = false, field = "event.code", queryType = "phrase", value = "7045", valueType = "string" },
190    ],
191]
192relativeFrom = "now-48h/h"
193relativeTo = "now"
194
195[[transform.investigate]]
196label = "Same service name across hosts"
197description = ""
198providers = [
199    [
200        { excluded = false, field = "winlog.event_data.ServiceName", queryType = "phrase", value = "{{winlog.event_data.ServiceName}}", valueType = "string" },
201        { excluded = false, field = "event.code", queryType = "phrase", value = "4697", valueType = "string" },
202    ],
203    [
204        { excluded = false, field = "winlog.event_data.ServiceName", queryType = "phrase", value = "{{winlog.event_data.ServiceName}}", valueType = "string" },
205        { excluded = false, field = "event.code", queryType = "phrase", value = "7045", valueType = "string" },
206    ],
207]
208relativeFrom = "now-48h/h"
209relativeTo = "now"
210[[rule.threat]]
211framework = "MITRE ATT&CK"
212[[rule.threat.technique]]
213id = "T1543"
214name = "Create or Modify System Process"
215reference = "https://attack.mitre.org/techniques/T1543/"
216[[rule.threat.technique.subtechnique]]
217id = "T1543.003"
218name = "Windows Service"
219reference = "https://attack.mitre.org/techniques/T1543/003/"
220
221
222
223[rule.threat.tactic]
224id = "TA0003"
225name = "Persistence"
226reference = "https://attack.mitre.org/tactics/TA0003/"
227
228[[rule.threat]]
229framework = "MITRE ATT&CK"
230
231[[rule.threat.technique]]
232id = "T1569"
233name = "System Services"
234reference = "https://attack.mitre.org/techniques/T1569/"
235
236[[rule.threat.technique.subtechnique]]
237id = "T1569.002"
238name = "Service Execution"
239reference = "https://attack.mitre.org/techniques/T1569/002/"
240
241[rule.threat.tactic]
242id = "TA0002"
243name = "Execution"
244reference = "https://attack.mitre.org/tactics/TA0002/"