Meterpreter or Cobalt Strike Getsystem Service Installation
Detects the installation of a new service by Meterpreter or Cobalt Strike's 'getsystem' command. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, combined with command-line patterns indicative of Meterpreter/Cobalt Strike's techniques for privilege escalation, such as using 'echo' to a named pipe, 'rundll32' with specific arguments, or creating a service from a local administrative share.
Sigma
