SigmaHQ/rules/windows/builtin/win_mal_service_installs.yml

30 lines
869 B
YAML
Raw Normal View History

2020-02-16 22:24:00 +00:00
title: Malicious Service Installations
id: 5a105d34-05fc-401e-8553-272b45c1522d
description: Detects known malicious service installs that only appear in cases of lateral movement, credential dumping and other suspicious activity
author: Florian Roth, Daniil Yugoslavskiy, oscd.community (update)
date: 2017/03/27
modified: 2019/11/01
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1003
- attack.t1035
- attack.t1050
- car.2013-09-005
logsource:
product: windows
service: system
detection:
selection:
EventID: 7045
malsvc_paexec:
ServiceFileName|contains: '\PAExec'
malsvc_wannacry:
ServiceName: 'mssecsvc2.0'
malsvc_persistence:
ServiceFileName|contains: 'net user'
condition: selection and 1 of malsvc_*
falsepositives:
- Penetration testing
level: critical