title: Service Installation in Suspicious Folder
id: 5e993621-67d4-488a-b9ae-b420d08b96cb
status: experimental
description: Detects service installation in suspicious folder appdata
author: pH-T
date: 2022/03/18
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
  suspicious1:
    ImagePath|contains:
      - '\AppData\'
      - '\\\\127.0.0.1'
      - '\\\\localhost'
  condition: selection and 1 of suspicious*
falsepositives:
  - Unknown
level: medium
tags:
  - attack.persistence
  - attack.privilege_escalation
  - car.2013-09-005
  - attack.t1543.003
