Service

Monitor for newly constructed services/daemons through Windows event logs for event IDs 4697 and 7045. ^[3] Deploy an LLMNR/NBT-NS spoofing detection tool.^[4]

Monitor Launch Agent creation through additional plist files and utilities such as Objective-See’s KnockKnock application.

Monitor for new constructed systemd services to repeatedly execute malicious payloads as part of persistence.

Creation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 ^[5][6]), especially those associated with unknown/abnormal drivers. New, benign services may be created during installation of new software.

Analytic 1 - Creation of new services with unusual directory paths such as temporal files in APPDATA

(sourcetype=WinEventLog:Security EventCode="4697") OR (sourcetype=WinEventLog:System EventCode="7045") | where ServiceFilePath LIKE "%APPDATA%" OR ServiceImage LIKE "%PUBLIC%"

Monitor for newly constructed services may create or modify Launch Daemons to execute malicious payloads as part of persistence.

Monitor for newly constructed services/daemons that may carry out malicious operations using a virtual instance to avoid detection. Consider monitoring for new Windows Service, with respect to virtualization software.

Monitor for newly constructed services/daemons. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

Monitor the creation or modification of Launch Agents or Launch Daemons via the launchctl command.

Analytic 1 - Create Service In Suspicious File Path

sourcetype=osquery| search service_action="create" OR service_action="modify"| where user NOT IN ("known_admins") AND service_name IN ("LaunchAgents", "LaunchDaemons")

Monitor newly constructed services that abuse control manager to execute malicious commands or payloads.

Analytic 1 - Suspicious Service Creation

sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System EventCode=4697 OR EventCode=7045| table _time, user, service_name, service_file_name, process_id| where service_file_name != "legitimate_software_path" // Exclude legitimate services

Monitor for abnormal process call trees from typical processes and services and for execution of other commands that could relate to Discovery or other adversary techniques.

Hashing of binaries and service executables could be used to detect replacement against historical data.

Monitor for telemetry that provides context of security software services being disabled or modified. In cloud environments, monitor virtual machine logs for the status of cloud security agents. Spyware and malware remain a serious problem and Microsoft developed security services, Windows Defender and Windows Firewall, to combat this threat. In the event Windows Defender or Windows Firewall is turned off, administrators should correct the issue immediately to prevent the possibility of infection or further infection and investigate to determine if caused by crash or user manipulation.Note: Windows Event code 7036 from the System log identifies if a service has stopped or started. This analytic looks for "Windows Defender" or "Windows Firewall" that has stopped.

Analytic 1 - User Activity from Stopping Windows Defensive Services

(source="WinEventLog:System" EventCode="7036") ServiceName="Windows Defender" OR ServiceName="Windows Firewall" AND ServiceName="stopped*"

Monitor for changes made to services for unexpected modifications to names, descriptions, and/or start types

Monitor for changes made to launch agents to repeatedly execute malicious payloads as part of persistence.

Analyze the contents of .service files present on the file system and ensure that they refer to legitimate, expected executables.

Monitor for changes made to Windows services to repeatedly execute malicious payloads as part of persistence.

Monitor services for changes made to Launch Daemons to execute malicious payloads as part of persistence.