Service installed with a shell, script host or UNC image path

Siemphony@siemphonyhighT1569.002unverified

AN1185 anchored on the service-creation record itself rather than on the process tree, which is what keeps it distinct from the DCOM and WMI execution rules already in this corpus: those match a child process on the target, this matches the moment Security 4697 registers a new service whose image is a command interpreter, a script host, a signed proxy binary, a PsExec-style temporary service, or a path on another machine. That is the common denominator of `sc create` with a command line for a binary, the Impacket service-execution family, and PsExec — all of them have to name something executable in ServiceFileName, and none of them can name a normal service binary. Only creation is in scope: an adversary who starts a service that already exists produces no 4697 at all and is invisible here, and the registry and network legs of AN1185 need MITRE's ParentProcessCorrelationWindow, which Sigma cannot express. 4697 requires Audit Security System Extension (Success), which is off in a default install — with it off this rule is blind rather than quiet. System log event 7045 carries the same facts without an audit policy, but it is a different log source than the one the brief names for this analytic. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0421, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

SecurityEvent| where (EventID == 4697 and (ServiceFileName contains "\\cmd.exe" or ServiceFileName contains "%COMSPEC%" or ServiceFileName contains "powershell" or ServiceFileName contains "\\pwsh.exe" or ServiceFileName contains "\\wscript.exe" or ServiceFileName contains "\\cscript.exe" or ServiceFileName contains "\\mshta.exe" or ServiceFileName contains "\\rundll32.exe" or ServiceFileName contains "\\regsvr32.exe" or ServiceFileName contains "PSEXESVC" or ServiceFileName contains "\\\\"))

Splunk · SPL

Run this as a search.

index=* (EventID="4697" AND (ServiceFileName="*\\cmd.exe*" OR ServiceFileName="*%COMSPEC%*" OR ServiceFileName="*powershell*" OR ServiceFileName="*\\pwsh.exe*" OR ServiceFileName="*\\wscript.exe*" OR ServiceFileName="*\\cscript.exe*" OR ServiceFileName="*\\mshta.exe*" OR ServiceFileName="*\\rundll32.exe*" OR ServiceFileName="*\\regsvr32.exe*" OR ServiceFileName="*PSEXESVC*" OR ServiceFileName="*\\\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (event.code == 4697 AND (TO_LOWER(ServiceFileName) LIKE "*\\\\cmd.exe*" OR TO_LOWER(ServiceFileName) LIKE "*%comspec%*" OR TO_LOWER(ServiceFileName) LIKE "*powershell*" OR TO_LOWER(ServiceFileName) LIKE "*\\\\pwsh.exe*" OR TO_LOWER(ServiceFileName) LIKE "*\\\\wscript.exe*" OR TO_LOWER(ServiceFileName) LIKE "*\\\\cscript.exe*" OR TO_LOWER(ServiceFileName) LIKE "*\\\\mshta.exe*" OR TO_LOWER(ServiceFileName) LIKE "*\\\\rundll32.exe*" OR TO_LOWER(ServiceFileName) LIKE "*\\\\regsvr32.exe*" OR TO_LOWER(ServiceFileName) LIKE "*psexesvc*" OR TO_LOWER(ServiceFileName) LIKE "*\\\\\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4697$</field>    <field name="ServiceFileName" type="pcre2">(?i)(\\cmd\.exe|%COMSPEC%|powershell|\\pwsh\.exe|\\wscript\.exe|\\cscript\.exe|\\mshta\.exe|\\rundll32\.exe|\\regsvr32\.exe|PSEXESVC|\\\\)</field>    <description>Service installed with a shell, script host or UNC image path</description>    <mitre>      <id>T1569.002</id>    </mitre>  </rule></group>

At a glance

Logsource: security / windows
Level: high
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 0f71c25c-8f8a-41f3-b8c2-7ef8c67a9d1c

ATT&CKT1569.002

T1569.002Service Execution

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonlateral movement remote exec

lateral movement remote execAI draft — unreviewed

01 · What this rule detects

The moment Windows records a new service being installed whose image path is a command interpreter, a script host, a signed proxy binary, a PsExec-style temporary service, or a path on another machine. MITRE's analytic AN1185 describes service execution broadly — sc.exe, net.exe, PsExec, services.exe spawning non-standard binaries. This rule anchors on the service-creation record itself rather than on the process tree, which keeps it distinct from the DCOM (T1021.003) and WMI (T1047) rules in this corpus: those match a child process on the target, this matches Security 4697. Only creation is in scope — starting a service that already exists produces no 4697 and is invisible here. AN1185's registry and network legs need MITRE's ParentProcessCorrelationWindow, which Sigma cannot express.

02 · Telemetry you need

Security EventID 4697, log source verbatim from the brief. This log source has
*4697 requires Audit Security System Extension* (Success), off in a default
ServiceFileName is genuinely a 4697 field — not ported in from 7045 or from
System log event 7045 carries the same facts with no audit policy, which is how

03 · How the logic works

The last term is the one to study. In Sigma, `\\` is one literal backslash, so a UNC prefix needs four backslashes in the YAML. Written as '\\' the term would collapse to "contains a backslash" — satisfied by every Windows path ever logged — and the selection would be permanently true while looking tight. This rule gets it right: '\\\\' is four characters in the file, two literal backslashes at match time, a real UNC gate. Check this every time you see a doubled separator in a Sigma value. Now the honest limits, all of which review found. The rule catches half the Impacket family it claims. smbexec.py builds a service whose image is %COMSPEC% /Q /c echo ... > \\127.0.0.1\C$\... and matches twice over. But psexec.py uploads RemComSvc under a randomly generated name and registers %SystemRoot%\<random>.exe — no cmd, no COMSPEC, no PSEXESVC, no UNC. Its 4697 matches nothing here. The plainest form of the technique is also missed. sc \\host create svc binPath= C:\Windows\Temp\payload.exe then sc start svc is textbook T1569.002 and hits none of the eleven substrings. Dropping an EXE and registering it is the default case, not the exception; only an allowlist-shaped rule on ServiceFileName covers it, and MITRE names that knob — ServiceBinaryAllowlist. `contains: 'powershell'` is unanchored. It matches any service image under C:\Program Files\WindowsPowerShell\, whether or not the binary is a PowerShell host. Prefer '\powershell.exe' alongside '\pwsh.exe'. The UNC arm has a milder version of the same issue: as a contains rather than a startswith, an extended-length or quoted path carrying a doubled separator satisfies it with nothing remote having happened.

04 · Common false positives

Sanctioned remote administration. Helpdesk and deployment teams run PsExec
Installers and update agents registering a service pointing at a wrapper script
**Monitoring, backup and endpoint-security products with a PowerShell-hosted
Services installed from a software-distribution share, where the image path is

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0421 and never executed against a single log line.
tier_2: begins by confirming Audit Security System Extension is enabled — otherwise every later measurement is measuring silence. Then baseline the interpreter terms, drop the level to match, and start the service-binary allowlist.
tier_3: needs the registry and network legs joined across ParentProcessCorrelationWindow, which belongs in your correlation layer.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's RemoteExecutionHosts knob holds the approved management servers that
MITRE's ServiceBinaryAllowlist knob is where the dropped-binary gap closes —
Split the UNC term into its own selection with |startswith: '\\\\'.
A service created for persistence is T1543.003, and the same 4697 carries

Declared by the author

Sanctioned remote administration. Helpdesk and deployment teams run PsExec and its equivalents legitimately, and the temporary service they leave behind is the same service an intruder creates — MITRE's RemoteExecutionHosts knob exists for exactly this, and until it is populated with the approved management servers the account and source host are the only things separating the two.
Software installers and update agents that register a service pointing at a wrapper script or at a stub that shells out, which is common in packaged line-of-business applications and produces a burst of hits during a deployment window.
Monitoring, backup and endpoint-security products whose service image is a PowerShell-hosted agent, matching the powershell term on every install and every version upgrade across the estate.
Services installed from a software distribution share, where the image path is genuinely a UNC path and matches the last term without anything unusual having happened.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1569.002, evaluated against their — events.

Share this rule

/u/siemphony/0f71c25c-8f8a-41f3-b8c2-7ef8c67a9d1c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Service installed with a shell, script host or UNC image path

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it