Remote Access Tool Service Installation or Start

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•23

This rule detects the installation or start of services associated with various legitimate remote access tools. Threat actors commonly abuse these tools to maintain persistence, escalate privileges, or establish command and control over compromised systems. The rule specifically looks for Event IDs 7045 (Service Installation) and 7036 (Service Started) from the 'Service Control Manager' provider, where the service name contains keywords indicative of known remote access software such as AmmyyAdmin, TeamViewer, LogMeIn, and others.