Detecting Remote Service Creation and Suspicious ImagePaths

Creating a service on a remote host is the shared mechanism beneath PsExec, smbexec, Cobalt Strike’s psexec and ransomware deployers. Rather than hunting each tool, treat the install event as the object: score the ImagePath, rank rare service names and attribute the install to a source through the logon that created it.

Signals at a Glance

Scoring the ImagePath

No single string identifies a malicious service, so score several properties of the ImagePath and alert above a threshold. Encoded PowerShell, a shell with a command switch, a user-writable directory, an unquoted path with spaces and no file extension each add weight. A Sigma rule captures the high-fidelity core:

title: Service Installed With Interpreter or Encoded Command ImagePath
logsource:
  product: windows
  service: system
detection:
  base:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
  interpreter:
    ImagePath|contains:
      - 'cmd.exe /c'
      - 'cmd /c'
      - '%COMSPEC%'
      - 'powershell'
      - 'pwsh'
      - 'mshta'
      - 'rundll32'
  encoded:
    ImagePath|contains:
      - ' -enc'
      - ' -EncodedCommand'
      - 'FromBase64String'
  writable:
    ImagePath|contains:
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
  condition: base and (interpreter or encoded or writable)
level: high
# tune/validate: add exclusions for installers that register services from ProgramData.

Rarity is the second axis. A service name seen on one host in thirty days is more interesting than one seen on hundreds. A fleet-wide count surfaces both random names and one-off tooling:

index=wineventlog (EventCode=7045 OR EventCode=4697)
| eval svc=coalesce(Service_Name, ServiceName), path=coalesce(Service_File_Name, ServiceFileName)
| stats dc(host) as hosts_seen count min(_time) as first values(path) as paths by svc
| where hosts_seen = 1 AND first > relative_time(now(), "-1d")
| eval name_len=len(svc)
| where name_len <= 8 OR match(svc, "^[A-Za-z]{8,16}$")
| sort - first
# tune/validate: field names differ between add-ons; confirm which event populates Service_File_Name.

Attributing the Source

• Event 4697 contains the creator’s logon ID. Join it to the 4624 type 3 logon with the same ID on the same host to recover the source address and account.
• Event 7045 lacks the creator, so pair it with Event 5145 file writes and 5140 share access in the preceding 60 seconds.
• Watch the lifecycle: 7045, then 7036 running, then a 7036 stop and service deletion. A service that exists for seconds is nearly always an execution vehicle, not software.
• Block the pattern: restrict who can create services remotely with the service control manager security descriptor, and use application control so unsigned binaries in system paths cannot run.