Service Installation in Suspicious Folder

Title: Service Installation in Suspicious Folder
Status: test
Description:Detects service installation in suspicious folder appdata
References:
  -Internal Research
Author: pH-T (Nextron Systems)
Date: 2022-03-18
modified:2024-01-18
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'car.2013-09-005'
• -'attack.t1543.003'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID: '7045'
    ImagePath|contains:
      -'\AppData\'
      -'\\\\127.0.0.1'
      -'\\\\localhost'

  filter_optional_zoom:
    ServiceName: 'Zoom Sharing Service'
    ImagePath|contains: ':\Program Files\Common Files\Zoom\Support\CptService.exe'
  condition:selection and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: medium