Service Installed by Unsigned Process

[rule]
description = """
Identifies the install of a new service by a process with no code signature or an invalid one. Adversaries may use this
technique to maintain persistence or run with System privileges.
"""
id = "9a5fefc6-2ec7-445a-8436-4ef894eff9a1"
license = "Elastic License v2"
name = "Service Installed by Unsigned Process"
os_list = ["windows"]
version = "1.0.3"

query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
  (process.Ext.relative_file_creation_time <= 900 or process.Ext.relative_file_name_modify_time <= 900) and
  (process.code_signature.trusted == false or process.code_signature.exists == false) and not process.code_signature.status like "errorCode_endpoint*" and
  not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")]
[any where event.category == "configuration" and event.action == "service_installed" and user.id != "S-1-5-18" and
 (process.code_signature.exists == false or process.code_signature.trusted == false) and
 not winlog.event_data.ServiceStartType in ("Manual", "Disabled")]
'''

min_endpoint_version = "9.0.0"
optional_actions = []
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "9.0.0"