Obfuscated PowerShell Execution via Stdin in Service Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the 'ImagePath' contains patterns indicative of obfuscated PowerShell execution via standard input (stdin). Specifically, it looks for the presence of 'set' and '&&' along with keywords like 'environment', 'invoke', or 'input' within the service's executable path, suggesting an attempt to execute obfuscated commands.