Remote Service Creation for Lateral Movement
This rule detects the creation of new Windows services where the executable path is suspicious. Suspicious paths include common temporary or user-writable directories like `Users\Public`, `ProgramData`, `AppData`, or `Windows\Temp`. Additionally, it flags services that directly execute `cmd.exe` or `powershell.exe` with suspicious arguments (e.g., encoded commands, hidden windows, or `/c` for command execution), or `rundll32.exe` from suspicious paths. It also identifies services with very short, alphanumeric names, which could indicate an attempt at masquerading.
Sigma
