Potential CobaltStrike Service Installations - Registry

Title: Potential CobaltStrike Service Installations - Registry
Status: test
Description:Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.
References:
  -https://www.sans.org/webcasts/tech-tuesday-workshop-cobalt-strike-detection-log-analysis-119395
Author: Wojciech Lesicki
Date: 2021-06-29
modified:2024-03-25
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.privilege-escalation'
• -'attack.lateral-movement'
• -'attack.t1021.002'
• -'attack.t1543.003'
• -'attack.t1569.002'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection_key:
TargetObject|contains:'\System\CurrentControlSet\Services'     - TargetObject|contains|all:
      - '\System\ControlSet'
      - '\Services'
  selection_details:
    - Details|contains|all:
      - 'ADMIN$'
      - '.exe'
    - Details|contains|all:
      - '%COMSPEC%'
      - 'start'
      - 'powershell'
  condition:all of selection_*
Falsepositives:
  -Unlikely
Level: high