FalconForce unknown stable kql

Create or Modify System Process: Windows Service

Windows services can be used as a means of persistence in an environment, and can be created in multiple ways, one of which is remotely. Doing so often involves this service creation will be executed over RPC.

View Source

Detection Logic

let netevents=DeviceNetworkEvents
| where ActionType == "InboundConnectionAccepted"
| where InitiatingProcessFolderPath == @"c:\windows\system32\services.exe"
// IMPORTANT There is some legitimate use for maintenance by support teams, filter their IP addresses/blocks below
| where not(RemoteIP has_any ("maintenance-ip-1","maintenance-ip-2","maintenance-ip-3"))
| project Timestamp,DeviceId,ActionType,InitiatingProcessFolderPath, DeviceName, RemoteIP, InitiatingProcessId;
let regevents=DeviceRegistryEvents
| where RegistryKey contains @"\System\CurrentControlSet\Services" or RegistryKey contains @"\System\ControlSet001\Services"
| where ActionType contains "Created"
| project DeviceId, ActionType, RegistryKey, RegistryValueType,RegistryValueData, InitiatingProcessFolderPath,InitiatingProcessId, DeviceName;
let rpcservices = 
	netevents
| join kind=leftouter  (regevents) on DeviceId, InitiatingProcessFolderPath,InitiatingProcessId;
rpcservices
| project Timestamp,DeviceName,RemoteIP,ActionType1 ,RegistryKey, RegistryValueType, RegistryValueData
| summarize count() by RemoteIP

Field Validations

Loading…

Comments (0)

Loading comments...