PowerShell Scripts Installed as Services

Title: PowerShell Scripts Installed as Services
Status: test
Description:Detects powershell script installed as a Service
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Author: oscd.community, Natalia Shornikova
Date: 2020-10-06
modified:2022-12-25
Tags:

• -'attack.execution'
• -'attack.t1569.002'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID: '7045'
    ImagePath|contains:
      -'powershell'
      -'pwsh'

  condition:selection
Falsepositives:
  -Unknown
Level: high