IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Service Control Spawned via Script Interpreter
editService Control Spawned via Script Interpreter
editIdentifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.
Rule type: eql
Rule indices:
- logs-endpoint.events.*
- logs-system.*
- winlogbeat-*
Severity: low
Risk score: 21
Runs every: 5 minutes
Searches indices from: now-9m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
Tags:
- Elastic
- Host
- Windows
- Threat Detection
- Lateral Movement
Version: 11 (version history)
Added (Elastic Stack release): 7.6.0
Last modified (Elastic Stack release): 8.2.0
Rule authors: Elastic
Rule license: Elastic License v2
Investigation guide
edit## Config If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
Rule query
edit/* This rule is not compatible with Sysmon due to user.id issues */ process where event.type == "start" and (process.name : "sc.exe" or process.pe.original_file_name == "sc.exe") and process.parent.name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe","powershell.exe", "pwsh.exe") and process.args:("config", "create", "start", "delete", "stop", "pause") and /* exclude SYSTEM SID - look for service creations by non-SYSTEM user */ not user.id : "S-1-5-18"
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Lateral Movement
- ID: TA0008
- Reference URL: https://attack.mitre.org/tactics/TA0008/
-
Technique:
- Name: Remote Services
- ID: T1021
- Reference URL: https://attack.mitre.org/techniques/T1021/
Rule version history
edit- Version 11 (8.2.0 release)
-
- Formatting only
- Version 10 (8.1.0 release)
-
-
Updated query, changed from:
process where event.type == "start" and (process.name : "sc.exe" or process.pe.original_file_name == "sc.exe") and process.parent.name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe","powershell.exe", "pwsh.exe") and process.args:("config", "create", "start", "delete", "stop", "pause") and /* exclude SYSTEM SID - look for service creations by non-SYSTEM user */ not user.id : "S-1-5-18"
-
- Version 9 (7.13.0 release)
-
- Rule name changed from: Local Service Commands
-
Updated query, changed from:
event.category:process and event.type:(start or process_started) and process.name:sc.exe and process.args:(config or create or failure or start)
- Version 8 (7.12.0 release)
-
- Formatting only
- Version 7 (7.11.2 release)
-
- Formatting only
- Version 6 (7.11.0 release)
-
- Formatting only
- Version 5 (7.10.0 release)
-
- Formatting only
- Version 4 (7.9.1 release)
-
- Formatting only
- Version 3 (7.9.0 release)
-
-
Updated query, changed from:
event.action:"Process Create (rule: ProcessCreate)" and process.name:sc.exe and process.args:(config or create or failure or start)
-
- Version 2 (7.7.0 release)
-
-
Updated query, changed from:
event.action:"Process Create (rule: ProcessCreate)" and process.name:sc.exe and process.args:("create" or "config" or "failure" or "start")
-