Hub configuration

Name: Suspicious New Service Creation
Author: sigmahq

More info

Suspicious New Service Creation Detection Scenario by sigmahq | CrowdSec Hub

« Suspicious New Service Creation »
v0.2 by sigmahq / proc_creation_win_susp_service_creation
Attack scenariowindowsNot spoofableLow confidence

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

Installation

cscli scenarios install sigmahq/proc_creation_win_susp_service_creation

YAML Configuration

1type: trigger
2name: sigmahq/proc_creation_win_susp_service_creation
3description: |
4  Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '\\sc.exe' && evt.Parsed.CommandLine contains 'create' && evt.Parsed.CommandLine contains 'binPath=' || evt.Parsed.CommandLine contains 'New-Service' && evt.Parsed.CommandLine contains '-BinaryPathName') && (evt.Parsed.CommandLine contains 'powershell' || evt.Parsed.CommandLine contains 'mshta' || evt.Parsed.CommandLine contains 'wscript' || evt.Parsed.CommandLine contains 'cscript' || evt.Parsed.CommandLine contains 'svchost' || evt.Parsed.CommandLine contains 'dllhost' || evt.Parsed.CommandLine contains 'cmd ' || evt.Parsed.CommandLine contains 'cmd.exe /c' || evt.Parsed.CommandLine contains 'cmd.exe /k' || evt.Parsed.CommandLine contains 'cmd.exe /r' || evt.Parsed.CommandLine contains 'rundll32' || evt.Parsed.CommandLine contains 'C:\\Users\\Public' || evt.Parsed.CommandLine contains '\\Downloads\\' || evt.Parsed.CommandLine contains '\\Desktop\\' || evt.Parsed.CommandLine contains '\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\' || evt.Parsed.CommandLine contains 'C:\\Windows\\TEMP\\' || evt.Parsed.CommandLine contains '\\AppData\\Local\\Temp'))
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1543.003
15
16  label: "Suspicious New Service Creation"
17  behavior : "windows:audit"
18  remediation: false
19
20scope:
21  type: ParentProcessId
22  expression: evt.Parsed.ParentProcessId
23
24

Hub configuration

« Suspicious New Service Creation »v0.2 by sigmahq / proc_creation_win_susp_service_creationAttack scenariowindowsNot spoofableLow confidenceMITRE:t1543

« Suspicious New Service Creation »
v0.2 by sigmahq / proc_creation_win_susp_service_creation
Attack scenariowindowsNot spoofableLow confidence