title: Service Installed With A Suspicious Image Path
id: d9343f55-910f-44f9-b46b-60e99f5a8354
status: experimental
description: |
  Detects event 7045 (a service was installed) where the image path runs a script interpreter or
  lives in a user-writable directory. Remote service creation is how PsExec-style lateral
  movement and a good share of persistence both land, and 7045 is written by default with no
  audit policy needed.
references:
  - https://attack.mitre.org/techniques/T1543/003/
  - https://attack.mitre.org/techniques/T1569/002/
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection_event:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
  selection_path:
    ImagePath|contains:
      - 'powershell'
      - 'pwsh'
      - 'cmd.exe /c'
      - 'cmd /c'
      - '%COMSPEC%'
      - 'rundll32'
      - 'regsvr32'
      - 'mshta'
      - '\Users\Public\'
      - '\AppData\'
      - '\Windows\Temp\'
      - 'ADMIN$'
  condition: all of selection_*
falsepositives:
  - Deployment tooling that installs a temporary service from ADMIN$, PsExec used by your own administrators included. Decide whether that is allowed; if it is, exclude by source host rather than by service name, which the operator chooses.
level: high