Writing a Sigma rule for suspicious service creation

Why this rule

Attackers often install a service to keep access to a machine. Real services almost never run from a user's profile or temp folder, so the path of the service binary is a good signal with few false positives.

The rule

Windows writes event 7045 to the System log when a new service is installed. The rule looks at the image path in that event.

title: Service Installed From User-Writable Path
status: experimental
description: A new service whose binary is under a user profile or temp folder.
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
    ImagePath|contains:
      - '\Users\'
      - '\AppData\'
      - '\Temp\'
  condition: selection
falsepositives:
  - Software installers that run from a temp folder during setup
level: high
tags:
  - attack.persistence
  - attack.t1543.003

Test it

Create a harmless test service that points at a file in a temp folder, confirm the event appears, then remove it.

PS> sc.exe create TestSvc binPath= "C:\Users\Public\test.exe"
PS> sc.exe delete TestSvc

Then convert the rule for your SIEM:

$ sigma convert -t splunk -p splunk_windows service-user-path.yml

Tuning

Run the converted query over a few weeks of logs first. Add the paths of known installers to an exclusion list, and keep the rule at high only if the false positives stay low.