
title: Turla Service Install
author: Florian Roth
date: 2017/03/31
description: This method detects a service install of malicious services mentioned
  in Carbon Paper - Turla report by ESET
detection:
  SELECTION_1:
    EventID: 7045
  SELECTION_2:
    ServiceName:
    - srservice
    - ipvpn
    - hkmsvc
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- Unknown
id: 1df8b3da-b0ac-4d8a-b7c7-6cb7c24160e4
level: high
logsource:
  product: windows
  service: system
references:
- https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/
status: experimental
tags:
- attack.persistence
- attack.g0010
- attack.t1050
- attack.t1543.003
ruletype: SIGMA
