Elastic low stable kql

Execution of an Unsigned Service

This rule identifies the execution of unsigned executables via service control manager (SCM). Adversaries may abuse SCM to execute malware or escalate privileges.

View Source

Detection Logic

host.os.type:windows and event.category:process and event.type:start and 
process.parent.executable:"C:\\Windows\\System32\\services.exe" and 
(process.code_signature.exists:false or process.code_signature.trusted:false) and
not process.code_signature.status : (errorCode_endpoint* or "errorChaining")

Field Validations

Loading…

Comments (0)

Loading comments...