CmdID

services.exe

Services and Controller app file version info

Program on Windows 10 known copies with hashes 22 Sigma rules name it

Is it the real services.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionServices and Controller app

10 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\services.exe · signed by Microsoft Windows

82d52b1fa2d566f974325533a0c9f1bc4e14d114225ba5c126480e5e6fd5eec0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\services.exe · signed by Microsoft Windows

2e18dc3466566df55792d6afad818d1e28ffa2c32017770a959419736db577ee

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\services.exe · signed by Microsoft Windows

41e785ff78c698c860be93f6f1f0a2369f8932d186d7d5e5bf97c0af4c6c466c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\services.exe · signed by Microsoft Windows

dfbea9e8c316d9bc118b454b0c722cd674c30d0a256340200e2c3a7480cba674

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\services.exe · signed by Microsoft Windows

ed68f485137406c9d41d34fa2cd8b1b45516ea8cdcd4eeca5fd6bc2c6edd22d6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\services.exe · signed by Microsoft Windows

f14cbe42e4c29c57acdf781388d387a01963075f255abf57d8486d7842257500

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\services.exe · signed by Microsoft Windows

9090e0e44e14709fb09b23b98572e0e61c810189e2de8f7156021bc81c3b1bb6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\services.exe · signed by Microsoft Windows

a2e369df26c88015fe1f97c7542d6023b5b1e4830c25f94819507ee5bcb1dfcc

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\services.exe · signed by Microsoft Windows

d99aa02447946efb935b11d21df99afdda0955a588d6aac42746de73e1253956

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\services.exe · signed by Microsoft Windows Publisher

d992114509a223bd092f6ff9a971f62d4a4715671a46d9fe88097e815bf57418

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name services.exe

criticalHAFNIUM Exchange Exploitation ActivityFlorian Roth (Nextron Systems)

highAbused Debug Privilege by Arbitrary Parent ProcessesSemanur Guneysu @semanurtg, oscd.community

highHackTool - Potential Impacket Lateral Movement ActivityEcco, oscd.community, Jonhnathan Ribeiro, Tim Rauch

highPotential Meterpreter/CobaltStrike ActivityTeymur Kheirkhabarov, Ecco, Florian Roth

highPotential SNAKE Malware Persistence Service ExecutionNasreddine Bencherchali (Nextron Systems)

highSuspicious PowerShell Parent ProcessTeymur Kheirkhabarov, Harish Segar

highSuspicious Service Binary DirectoryFlorian Roth (Nextron Systems)

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

mediumAlways Install Elevated Windows InstallerTeymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community

mediumConhost Spawned By Uncommon Parent ProcessTim Rauch, Elastic (idea)

mediumExecution From Webserver Root FolderFlorian Roth (Nextron Systems)

mediumExecution of Suspicious File Type ExtensionMax Altgelt (Nextron Systems)

mediumUncommon Svchost Parent ProcessFlorian Roth (Nextron Systems)

lowWindows Processes Suspicious Parent Directoryvburov

Sigma names services.exe in 22 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.