CmdID

CmdID / Rules / Windows

New Service Creation Using PowerShell

A Sigma rule for process creation on Windows, by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community.

low 1 ATT&CK technique 1 everyday example trips it

What it looks for

its detection, as SigmaHQ writes it
detection:
  selection:
    CommandLine|contains|all:
      - 'New-Service'
      - '-BinaryPathName'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Create a service on the page for New-Service

New-Service -Name "TestService" -BinaryPathName 'C:\WINDOWS\System32\svchost.exe -k netsvcs'Identify

ATT&CK

the techniques it is tagged with
T1543.003Create or Modify System Process: Windows Service

Other rules for T1543.003 Create or Modify System Process: Windows Service

Devcon Execution Disabling VMware VMCI Device · Suspicious Service DACL Modification Via Set-Service Cmdlet · PUA - Kernel Driver Utility (KDU) Execution · New Service Creation Using Sc.EXE · New Kernel Driver Via SC.EXE · Allow Service Access Using Security Descriptor Tampering Via Sc.EXE · Deny Service Access Using Security Descriptor Tampering Via Sc.EXE · Suspicious Service Path Modification · Potential Persistence Attempt Via Existing Service Tampering · Suspicious New Service Creation · Sysinternals PsService Execution · Sysinternals PsSuspend Execution