
title: CobaltStrike Service Installations in Registry
author: Wojciech Lesicki
date: 2021/06/29
description: Detects known malicious service installs that appear in cases in which
  a Cobalt Strike beacon elevates privileges or lateral movement. We can also catch
  this by system log 7045 (https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_cobaltstrike_service_installs.yml)
  In some SIEM you can catch those events also in HKLM\System\ControlSet001\Services
  or HKLM\System\ControlSet002\Services, however, this rule is based on a regular
  sysmon's events.
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_10:
    Details: '*powershell*'
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    EventType: SetValue
  SELECTION_5:
    TargetObject: '*HKLM\System\CurrentControlSet\Services*'
  SELECTION_6:
    Details: '*ADMIN$*'
  SELECTION_7:
    Details: '*.exe*'
  SELECTION_8:
    Details: '*%COMSPEC%*'
  SELECTION_9:
    Details: '*start*'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and SELECTION_5
    and ((SELECTION_6 and SELECTION_7) or (SELECTION_8 and SELECTION_9 and SELECTION_10)))
falsepositives:
- unknown
id: 61a7697c-cb79-42a8-a2ff-5f0cdfae0130
level: critical
logsource:
  category: registry_event
  product: windows
references:
- https://www.sans.org/webcasts/tech-tuesday-workshop-cobalt-strike-detection-log-analysis-119395
status: experimental
tags:
- attack.execution
- attack.privilege_escalation
- attack.lateral_movement
- attack.t1021.002
- attack.t1543.003
- attack.t1569.002
ruletype: SIGMA
