The Gentlemen Go Backdoor Installed as Windows Service from Non-Standard Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

This rule detects the creation of a new Windows service where the executable path is located in suspicious directories (e.g., ProgramData, AppData, Temp, Users Public). It correlates the service installation event (using sc.exe) with the subsequent execution of the binary by services.exe within a two-hour window, identifying potential persistence mechanisms or malicious service-based execution.