Orangeworm Attack Group

• First Time Seen Running Windows Service :
  endpoint Endpoint risk_score:25 2024-10-17 version:6
  The following analytic detects the first occurrence of a Windows service running in your environment. It leverages Windows system event logs, specifically EventCode 7036, to identify services entering the "running" state. This activity is significant because the appearance of a new or previously unseen service could indicate the installation of unauthorized or malicious software. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, maintain persistence, or escalate privileges within the environment. Monitoring for new services helps in early detection of potential threats.


• First time seen command line argument :
  endpoint Endpoint risk_score:25 2024-10-17 version:7
  This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen.


• Sc exe Manipulating Windows Services :
  endpoint Endpoint risk_score:56 2024-09-30 version:6
  The following analytic detects the creation or modification of Windows services using the sc.exe command. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because manipulating Windows services can be a method for attackers to establish persistence, escalate privileges, or execute arbitrary code. If confirmed malicious, this behavior could allow an attacker to maintain long-term access, disrupt services, or gain control over critical system functions, posing a severe threat to the environment.