Service Installed By Unusual Client - System

Title: Service Installed By Unusual Client - System
Status: test
Description:Detects a service installed by a client which has PID 0 or whose parent has PID 0
References:
  -https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html
Author: Tim Rauch (Nextron Systems), Elastic (idea)
Date: 2022-09-15
modified:2023-01-04
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1543'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID: '7045'
    ProcessId: '0'
  condition:selection
Falsepositives:
  -Unknown
Level: high