Suspicious Service Installation Command Patterns

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects suspicious service installations by monitoring Event ID 7045 from the Service Control Manager. The rule looks for specific command-line patterns in the ImagePath field that are commonly associated with malicious service creation, such as PowerShell download commands, hidden windows, or execution from temporary directories.