MITRE CAR unknown stable spl

Create Service In Suspicious File Path

This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows.

View Source

Detection Logic

`wineventlog_system` EventCode=7045  Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "%windir%\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) Service_Type = "user mode service"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type

Field Validations

Loading…

Comments (0)

Loading comments...