System Process Created or Modified Remotely via SMB

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to remotely create or modify services on a target system via SMB, specifically looking for the 'CreateService' string within TCP traffic on port 445. It thresholds on 3 occurrences from the same source within 60 seconds to reduce false positives.