Create Service In Suspicious File Path
Hypothesis and description
This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows.
- Platforms
- Windows
- Domain
- Analytic
- Subtypes
- Process
- Submitted
- 2021-05-11 (updated 2021-04-05)
- Contributors
- Splunk Threat Research <research@splunk.com>
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1569 System ServicesT1569.001, T1569.002 | Execution | Moderate |
1 technique, 3 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
PseudocodePseudocode - Service in Suspicious File PathData model: CAR native
Pseudocode implementation of the Splunk search below.
services = search Service:create
suspicious_services = filter services where image_path = "*\.exe" AND image_path does not contain ["C:\\Windows\\*", "%windir%\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*"] )
output suspicious_servicesSplunkSplunk codeData model: Endpoint
To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
`wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "%windir%\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) Service_Type = "user mode service" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type