This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
Service Control Spawned via Script Interpreter
editService Control Spawned via Script Interpreter
editIdentifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.
Rule type: eql
Rule indices:
- logs-endpoint.events.*
- logs-system.*
- winlogbeat-*
Severity: low
Risk score: 21
Runs every: 5 minutes
Searches indices from: now-9m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
Tags:
- Elastic
- Host
- Windows
- Threat Detection
- Lateral Movement
Version: 100 (version history)
Added (Elastic Stack release): 7.6.0
Last modified (Elastic Stack release): 8.5.0
Rule authors: Elastic
Rule license: Elastic License v2
Investigation guide
editRule query
edit/* This rule is not compatible with Sysmon due to user.id issues */ process where event.type == "start" and (process.name : "sc.exe" or process.pe.original_file_name == "sc.exe") and process.parent.name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe","powershell.exe", "pwsh.exe") and process.args:("config", "create", "start", "delete", "stop", "pause") and /* exclude SYSTEM SID - look for service creations by non-SYSTEM user */ not user.id : "S-1-5-18"
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Lateral Movement
- ID: TA0008
- Reference URL: https://attack.mitre.org/tactics/TA0008/
-
Technique:
- Name: Remote Services
- ID: T1021
- Reference URL: https://attack.mitre.org/techniques/T1021/
Rule version history
edit- Version 100 (8.5.0 release)
-
- Formatting only
- Version 13 (8.4.0 release)
-
- Formatting only
- Version 11 (8.2.0 release)
-
- Formatting only
- Version 10 (8.1.0 release)
-
-
Updated query, changed from:
process where event.type == "start" and (process.name : "sc.exe" or process.pe.original_file_name == "sc.exe") and process.parent.name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe","powershell.exe", "pwsh.exe") and process.args:("config", "create", "start", "delete", "stop", "pause") and /* exclude SYSTEM SID - look for service creations by non-SYSTEM user */ not user.id : "S-1-5-18"
-
- Version 9 (7.13.0 release)
-
- Rule name changed from: Local Service Commands
-
Updated query, changed from:
event.category:process and event.type:(start or process_started) and process.name:sc.exe and process.args:(config or create or failure or start)
- Version 8 (7.12.0 release)
-
- Formatting only
- Version 7 (7.11.2 release)
-
- Formatting only
- Version 6 (7.11.0 release)
-
- Formatting only
- Version 5 (7.10.0 release)
-
- Formatting only
- Version 4 (7.9.1 release)
-
- Formatting only
- Version 3 (7.9.0 release)
-
-
Updated query, changed from:
event.action:"Process Create (rule: ProcessCreate)" and process.name:sc.exe and process.args:(config or create or failure or start)
-
- Version 2 (7.7.0 release)
-
-
Updated query, changed from:
event.action:"Process Create (rule: ProcessCreate)" and process.name:sc.exe and process.args:("create" or "config" or "failure" or "start")
-