title: Suspicious Service Installation Script
id: 70f00d10-60b2-4f34-b9a0-dc3df3fe762a
status: experimental
description: Detects suspicious service installation scripts
author: pH-T
date: 2022/03/18
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
  suspicious1:
    ImagePath|contains|all: ' /C '
    ImagePath|contains:
      - 'powershell'
      - 'wscript'
      - 'cscript'
      - 'mshta'
      - 'rundll32'
  condition: selection and 1 of suspicious*
falsepositives:
  - Unknown
level: high
tags:
  - attack.persistence
  - attack.privilege_escalation
  - car.2013-09-005
  - attack.t1543.003
