Moriya Rootkit Service Installation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•24

Detects the creation of a service named 'ZzNetSvc' which is associated with the Moriya rootkit, as described in the 'Operation TunnelSnake' report by Securelist. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation.