SigmaHQ/rules/windows/builtin/win_rare_service_installs.yml

title: Rare Service Installs
description: Detects rare service installs that only appear a few times per time frame and could reveal password dumpers, backdoor installs or other types of malicious services 
status: experimental
author: Florian Roth
tags:
    - attack.persistence
    - attack.privilege_escalation
    - attack.t1050
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
    timeframe: 7d
    condition: selection | count() by ServiceFileName < 5 
falsepositives: 
    - Software installation
    - Software updates
level: low
Rule: Rare Windows Service Installs 2017-03-08 18:09:34 +00:00			`title: Rare Service Installs`
Bugfixes and improvements 2017-03-21 09:24:20 +00:00			`description: Detects rare service installs that only appear a few times per time frame and could reveal password dumpers, backdoor installs or other types of malicious services`
Rule: Rare Windows Service Installs 2017-03-08 18:09:34 +00:00			`status: experimental`
			`author: Florian Roth`
Add tags to windows builtin rules 2018-07-24 05:50:32 +00:00			`tags:`
			`- attack.persistence`
			`- attack.privilege_escalation`
			`- attack.t1050`
Rule: Rare Windows Service Installs 2017-03-08 18:09:34 +00:00			`logsource:`
			`product: windows`
			`service: system`
			`detection:`
			`selection:`
			`EventID: 7045`
			`timeframe: 7d`
Update win_rare_service_installs.yml same count() by ServiceFileName < 5 aded to make sigmac work with elastalert integration 2018-12-05 02:33:56 +00:00			`condition: selection \| count() by ServiceFileName < 5`
Rule: Rare Windows Service Installs 2017-03-08 18:09:34 +00:00			`falsepositives:`
			`- Software installation`
			`- Software updates`
Update win_rare_service_installs.yml same count() by ServiceFileName < 5 aded to make sigmac work with elastalert integration 2018-12-05 02:33:56 +00:00			`level: low`