ID | Technique | Tactic |
---|---|---|
T1543 | Create or Modify System Process | Persistence |
T1543.003 | Windows Service | Privilege Escalation |
Detection: Randomly Generated Windows Service Name
EXPERIMENTAL DETECTION
This detection status is set to experimental. The Splunk Threat Research team has not yet fully tested, simulated, or built comprehensive datasets for this detection. As such, this analytic is not officially supported. If you have any questions or concerns, please reach out to us at research@splunk.com.
Description
The following analytic detects the installation of a Windows Service with a suspicious, high-entropy name, indicating potential malicious activity. It leverages Event ID 7045 and the ut_shannon
function from the URL ToolBox Splunk application to identify services with random names. This behavior is significant as adversaries often use randomly named services for lateral movement and remote code execution. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
Search
1`wineventlog_system` EventCode=7045
2| lookup ut_shannon_lookup word as Service_Name
3| where ut_shannon > 3
4| table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name
5| `randomly_generated_windows_service_name_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
Windows Event Log System 7045 | Windows | 'xmlwineventlog' |
'XmlWinEventLog:System' |
Macros Used
Name | Value |
---|---|
wineventlog_system | eventtype=wineventlog_system |
randomly_generated_windows_service_name_filter | search * |
randomly_generated_windows_service_name_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | False |
Implementation
To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. The Windows TA as well as the URL ToolBox application are also required.
Known False Positives
Legitimate applications may use random Windows Service names.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
A Windows Service with a suspicious service name was installed on $ComputerName$ | 45 | 90 | 50 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | Not Applicable | N/A | N/A | N/A |
Unit | ❌ Failing | N/A | N/A |
N/A |
Integration | ❌ Failing | N/A | N/A |
N/A |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 4