sigma-rules/rules/windows/persistence_services_registry.toml

[metadata]
creation_date = "2020/11/18"
maturity = "production"
updated_date = "2020/11/18"

[rule]
author = ["Elastic"]
description = """
Identifies processes modifying the services registry key directly, instead of through the expected Windows APIs. This
could be an indication of an adversary attempting to stealthily persist through abnormal service creation or
modification of an existing service.
"""
index = ["winlogbeat-*", "logs-endpoint.events.*"]
language = "eql"
license = "Elastic License"
name = "Unusual Persistence via Services Registry"
risk_score = 21
rule_id = "403ef0d3-8259-40c9-a5b6-d48354712e49"
severity = "low"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Persistence"]
type = "eql"

query = '''
registry where registry.path : ("HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ServiceDLL", "HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath") and
  not registry.data.strings : ("C:\\windows\\system32\\Drivers\\*.sys", 
                               "\\SystemRoot\\System32\\drivers\\*.sys", 
                               "system32\\DRIVERS\\USBSTOR") and
  not (process.name : "procexp??.exe" and registry.data.strings : "C:\\*\\procexp*.sys") and
  not process.executable : ("C:\\Program Files*\\*.exe", 
                            "C:\\Windows\\System32\\svchost.exe", 
                            "C:\\Windows\\winsxs\\*\\TiWorker.exe", 
                            "C:\\Windows\\System32\\drvinst.exe", 
                            "C:\\Windows\\System32\\services.exe", 
                            "C:\\Windows\\System32\\msiexec.exe", 
                            "C:\\Windows\\System32\\regsvr32.exe")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1050"
name = "New Service"
reference = "https://attack.mitre.org/techniques/T1050/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"