Meterpreter or Cobalt Strike Getsystem Service Installation
This rule detects the installation of a new service that exhibits characteristics commonly associated with the Meterpreter or Cobalt Strike 'getsystem' command. Specifically, it looks for Event ID 4697 (A service was installed in the system) and then analyzes the 'ServiceFileName' for patterns indicative of these tools. It identifies two main techniques: one involving 'cmd.exe' or '%COMSPEC%' echoing data to a named pipe (e.g., `echo 559891bb017 > \\.\pipe\5e120a`), and another involving 'rundll32.exe' loading a DLL with specific arguments (e.g., `rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn`). Additionally, it flags service installations where the 'ServiceFileName' starts with a specific network share path (`\\127.0.0.1\ADMIN$\`). These methods are typically used by adversaries to escalate privileges to SYSTEM.
Sigma
