OilRig APT Service Creation for Persistence

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•21

Detects the creation of specific Windows services ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in their March 2018 report. This rule monitors EventID 7045 from the 'Service Control Manager' provider.