Service Creation (5297a638-1382-4f0c-8472-0d21830bf705)
The registration of a new service or daemon on an operating system.
Data Collection Measures:
- Windows Event Logs
- Event ID 4697 - Captures the creation of a new Windows service.
- Event ID 7045 - Captures services installed by administrators or adversaries.
- Event ID 7034 - Could indicate malicious service modification or exploitation.
- Sysmon Logs
- Sysmon Event ID 1 - Process Creation (captures service executables).
- Sysmon Event ID 4 - Service state changes (detects service installation).
- Sysmon Event ID 13 - Registry modifications (captures service persistence changes).
- PowerShell Logging
- Monitor
New-ServiceandSet-ServicePowerShell cmdlets in Event ID 4104 (Script Block Logging).
- Monitor
- Linux/macOS Collection Methods
- AuditD & Syslog Daemon Logs (
/var/log/syslog,/var/log/messages,/var/log/daemon.log) - AuditD Rules:
auditctl -w /etc/systemd/system -p wa -k service_creation- Detects changes to
systemdservice configurations.
- AuditD & Syslog Daemon Logs (
- Systemd Journals (
journalctl -u <service_name>)- Captures newly created systemd services.
- LaunchDaemons & LaunchAgents (macOS)
- Monitor
/Library/LaunchDaemons/and/Library/LaunchAgents/for new plist files.
- Monitor