Suspicious Service Installation with Scripting Interpreters

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•3

This rule detects the creation of new Windows services (EventID 7045) where the service executable path does not reside in a standard System32 directory (unless it's in a Temp directory) and the executable name contains common scripting interpreters like 'powershell', 'cmd', or 'cscript'. This pattern is often indicative of persistence mechanisms established by adversaries using scripting languages.