Rare service DLL was added to the registry

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
Detector Tags	Malicious Service Analytics
ATT&CK Tactic	Stealth (TA0005), Persistence (TA0003)
ATT&CK Technique	Masquerading: Masquerade Task or Service (T1036.004), Create or Modify System Process: Windows Service (T1543.003)
Severity	Low

Description

A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.

Attacker's Goals

Masquerade execution on the host using a benign Windows process and achieve persistence.

Investigative actions

• Investigate the suspicious DLL and check for malicious content.
• Go to the service registry key and investigate it to find the associated executable that runs the service.
• Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Variations

Rare service DLL was added to the registry from an injected thread

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005), Persistence (TA0003)
ATT&CK Technique	Masquerading: Masquerade Task or Service (T1036.004), Create or Modify System Process: Windows Service (T1543.003)
Severity	Medium

Description

A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.

Attacker's Goals

Masquerade execution on the host using a benign Windows process and achieve persistence.

Investigative actions

• Investigate the suspicious DLL and check for malicious content.
• Go to the service registry key and investigate it to find the associated executable that runs the service.
• Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Rare service DLL was added to the registry from a rare unsigned actor process

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005), Persistence (TA0003)
ATT&CK Technique	Masquerading: Masquerade Task or Service (T1036.004), Create or Modify System Process: Windows Service (T1543.003)
Severity	High

Description

A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.

Attacker's Goals

Masquerade execution on the host using a benign Windows process and achieve persistence.

Investigative actions

• Investigate the suspicious DLL and check for malicious content.
• Go to the service registry key and investigate it to find the associated executable that runs the service.
• Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.