Detection: Randomly Generated Windows Service Name

EXPERIMENTAL DETECTION

This detection status is set to experimental. The Splunk Threat Research team has not yet fully tested, simulated, or built comprehensive datasets for this detection. As such, this analytic is not officially supported. If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2024-10-17 ID: 2032a95a-5165-11ec-a2c3-3e22fbd008af Author: Mauricio Velazco, Splunk Type: Hunting Product: Splunk Enterprise Security

Description

The following analytic detects the installation of a Windows Service with a suspicious, high-entropy name, indicating potential malicious activity. It leverages Event ID 7045 and the ut_shannon function from the URL ToolBox Splunk application to identify services with random names. This behavior is significant as adversaries often use randomly named services for lateral movement and remote code execution. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.

1`wineventlog_system` EventCode=7045 
2| lookup ut_shannon_lookup word as Service_Name 
3| where ut_shannon > 3 
4| table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name 
5| `randomly_generated_windows_service_name_filter`

Data Source

Name Platform Sourcetype Source
Windows Event Log System 7045 Windows icon Windows 'xmlwineventlog' 'XmlWinEventLog:System'

Macros Used

Name Value
wineventlog_system eventtype=wineventlog_system
randomly_generated_windows_service_name_filter search *
randomly_generated_windows_service_name_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1543 Create or Modify System Process Persistence
T1543.003 Windows Service Privilege Escalation
KillChainPhase.EXPLOITAITON
KillChainPhase.INSTALLATION
NistCategory.DE_AE
Cis18Value.CIS_10
APT19
APT3
APT32
APT38
APT41
Agrius
Aquatic Panda
Blue Mockingbird
Carbanak
Cinnamon Tempest
Cobalt Group
DarkVishnya
Earth Lusca
FIN7
Ke3chang
Kimsuky
Lazarus Group
PROMETHIUM
TeamTNT
Threat Group-3390
Tropic Trooper
Wizard Spider

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event False
This configuration file applies to all detections of type hunting.

Implementation

To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. The Windows TA as well as the URL ToolBox application are also required.

Known False Positives

Legitimate applications may use random Windows Service names.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
A Windows Service with a suspicious service name was installed on $ComputerName$ 45 90 50
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation Not Applicable N/A N/A N/A
Unit ❌ Failing N/A N/A N/A
Integration ❌ Failing N/A N/A N/A

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 5