Remote Windows Service Installation via SMB
This rule detects attempts to remotely install Windows services over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "svcctl" and "CreateService" in a case-insensitive manner, indicating a service control request to create a new service. This activity is often associated with adversaries establishing persistence on a compromised system.
Suricata
