HackTool Service Registration or Execution

Title: HackTool Service Registration or Execution
Status: test
Description:Detects installation or execution of services
References:
  -Internal Research
Author: Florian Roth (Nextron Systems)
Date: 2022-03-21
modified:2023-08-07
Tags:

• -'attack.execution'
• -'attack.t1569.002'
• -'attack.s0029'

Logsource:

• product: windows
• service: system

Detection:
  selection_eid:
    Provider_Name: 'Service Control Manager'
    EventID:
      -'7045'
      -'7036'

  selection_service_name:
    ServiceName|contains:
      -'cachedump'
      -'DumpSvc'
      -'gsecdump'
      -'pwdump'
      -'UACBypassedService'
      -'WCE SERVICE'
      -'WCESERVICE'
      -'winexesvc'

  selection_service_image:
    ImagePath|contains: 'bypass'
  condition:selection_eid and 1 of selection_service_*
Falsepositives:
  -Unknown
Level: high