Detection: Windows Service Created with Suspicious Service Name

Description

The following analytic detects the creation of a Windows Service with a known suspicious or malicious name using Windows Event ID 7045. It leverages logs from the wineventlog_system to identify these services installations. This activity is significant as adversaries, including those deploying Clop ransomware, often create malicious services for lateral movement, remote code execution, persistence, and execution. If confirmed malicious, this could allow attackers to maintain persistence, execute arbitrary code, and potentially escalate privileges, posing a severe threat to the environment.

Search

 1`wineventlog_system` EventCode=7045 
 2
 3| stats values(ImagePath) as process, count, min(_time) as firstTime, max(_time) as lastTime values(EventCode) as signature by Computer, ServiceName, StartType, ServiceType, UserID
 4
 5| eval process_name = mvindex(split(process,"\\"),-1)
 6
 7| rename Computer as dest, ServiceName as object_name, ServiceType as object_type, UserID as user_id
 8
 9| lookup windows_suspicious_services service_name as object_name
10
11| where isnotnull(tool_name)
12
13| `security_content_ctime(firstTime)` 
14
15| `security_content_ctime(lastTime)` 
16
17| `windows_service_created_with_suspicious_service_name_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log System 7045	Windows	'xmlwineventlog'	'XmlWinEventLog:System'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.

Known False Positives

Legitimate applications may install services with uncommon services paths.

Associated Analytic Story

• Active Directory Lateral Movement

• Brute Ratel C4

• CISA AA23-347A

• Clop Ransomware

• Flax Typhoon

• PlugX

• Qakbot

• Snake Malware

Risk Based Analytics (RBA)

Risk Message:

A known malicious service name $object_name$ was created using $process$ on $dest$, this may indicate the presence of [$tool_name$]

References

• https://attack.mitre.org/techniques/T1569/002/

• https://github.com/BishopFox/sliver/blob/71f94928bf36c1557ea5fbeffa161b71116f56b2/client/command/exec/psexec.go#LL61C5-L61C16

• https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/

• https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_services_names_list.csv

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1