DetectionCAR-2013-09-005

Service Outlier Executables

Hypothesis and description

New executables that are started as a service are suspicious. This analytic looks for anomalous service executables.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2013-09-23
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1543 Create or Modify System ProcessT1543.003	Persistence	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1543Create or Modify System Process
.003 Windows Service

D3FEND techniques MITRE maps to this analytic

D3-PLA Process Lineage Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

process/create/parent_image_path

Pseudocode and implementations

Pseudocode

Create a baseline of services seen over the last 30 days and a list of services seen today. Remove services in the baseline from services seen today, leaving a list of new services.

processes = search Process:Create
services = filter processes where (parent_image_path == "C:\Windows\System32\services.exe")
historic_services = filter services (where timestamp < now - 1 day AND timestamp > now - 1 day)
current_services = filter services (where timestamp >= now - 1 day)
new_services = historic_services - current_services
output new_services

SigmaSigma (Windows Event Log)

Sigma/Windows Event Log rule with similar logic to the above pseudocode

MITRE published no code for this implementation.

LogPointData model: LogPoint native

LogPoint version of the above sigma rule.

norm_id=WinServer event_id=7045
| chart count() as cnt by file
| search cnt < 5

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

3 more in the full list

View CAR-2013-09-005 on car.mitre.org