sigma-rules/rules/ml/ml_windows_anomalous_service.toml

[metadata]
creation_date = "2020/03/25"
maturity = "production"
updated_date = "2021/03/03"

[rule]
anomaly_threshold = 50
author = ["Elastic"]
description = """
A machine learning job detected an unusual Windows service, This can indicate execution of unauthorized services,
malware, or persistence mechanisms. In corporate Windows environments, hosts do not generally run many rare or unique
services. This job helps detect malware and persistence mechanisms that have been installed and run as a service.
"""
false_positives = [
    """
    A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this
    alert.
    """,
]
from = "now-45m"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "windows_anomalous_service"
name = "Unusual Windows Service"
references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"]
risk_score = 21
rule_id = "1781d055-5c66-4adf-9c71-fc0fa58338c7"
severity = "low"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "ML"]
type = "machine_learning"