New Service Creation Using PowerShell

 1title: New Service Creation Using PowerShell
 2id: c02e96b7-c63a-4c47-bd83-4a9f74afcfb2
 3related:
 4    - id: 85ff530b-261d-48c6-a441-facaa2e81e48 # Using Sc.EXE
 5      type: similar
 6status: test
 7description: Detects the creation of a new service using powershell.
 8references:
 9    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md
10author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
11date: 2023/02/20
12tags:
13    - attack.persistence
14    - attack.privilege_escalation
15    - attack.t1543.003
16logsource:
17    category: process_creation
18    product: windows
19detection:
20    selection:
21        CommandLine|contains|all:
22            - 'New-Service'
23            - '-BinaryPathName'
24    condition: selection
25falsepositives:
26    - Legitimate administrator or user creates a service for legitimate reasons.
27    - Software installation
28level: low