Service Installed By Unusual Client (PID 0)

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•27

Detects the creation of a new Windows service where the client process or its parent process has a Process ID (PID) of 0. A PID of 0 typically indicates the System Idle Process, which should not be initiating service installations. This behavior can be indicative of highly privileged malware or rootkits attempting to establish persistence or escalate privileges by creating services in an unusual context.