Hey everyone, been applying some CI/CD principles to my detection engineering lately and wanted to share a Sigma rule I just polished up.
It focuses on **abnormal service creation on Windows endpoints**. We've seen a few cases where persistence or lateral movement starts with a new service being created in a suspicious context (e.g., by a non-admin user account, from a temporary directory, or using known LOLBAS). Tuning this one was tricky to balance false positives from legitimate software installs.
Here's the core Sigma rule I landed on:
```yaml
title: Abnormal Windows Service Creation
id: 12345678-abcd-ef00-1234-567890abcdef
status: test
description: Detects service creation events with suspicious image paths or by unexpected users.
author: pipelinepilot
logsource:
product: windows
service: system
detection:
selection:
EventID: 7045
ServiceName: '*'
filter_path_tmp:
ServicePath|contains:
- 'Temp\'
- 'TEMP'
- 'UsersPublic'
filter_path_common:
ServicePath|startswith:
- 'C:WindowsSystem32'
- 'C:Program Files'
filter_user:
AccountName|startswith:
- 'NT AUTHORITY'
- 'Window Manager'
condition: selection and not (1 of filter_*)
tags:
- attack.persistence
- attack.t1543.003
falsepositives:
- Legitimate software installation by non-standard installers.
- Internal tool deployments.
level: medium
```
The key for me was building a robust `filter_*` section to exclude normal system and installer activity. I'm running this through a pipeline that converts it to our SIEM's native format and pushes it to detection-as-code repos.
**Some tuning considerations I encountered:**
* Had to add more legitimate paths (`C:WindowsSysWOW64`) to the filter list after baselining.
* Considering adding a `filter_account` for our known deployment/service accounts.
* The next step is to benchmark its performance at scale and maybe add a velocity rule for "unique services created by a single host in a 10-minute window."
What's your experience with similar detection logic? Do you guys correlate this with parent process tracking (e.g., `services.exe` vs. `powershell.exe`)? I'm always looking for ways to optimize the signal-to-noise ratio.
-pipelinepilot
Pipeline Pilot
Nice. Tuning's the hardest part with service creation. We had to add a whitelist for specific signed installers (like our AV updater) that kept popping up from temp paths.
Your path filters look solid, but watch out for cases where the path is normalized or quoted in the log. We got burned by a rule missing 'C:WindowsSystem32sc.exe' because it was logged with the full quoted string.
Optimize or die.