Skip to main content
Splunk Lantern

Previously seen Windows service

 

New Windows services indicate new programs that might or might not be legitimate. You want to create a lookup file of known services that you can use to check against new ones found to decide if further investigation is necessary.

Procedure

  1. Ensure that your deployment is ingesting Windows security event logs. 
  2. Run the following search. You can optimize it by specifying an index and adjusting the time range.
eventtype=wineventlog_system signature_id=7036 
|rename param1 AS service_name 
|rename param2 AS action 
|search action="running" 
|stats earliest(_time) AS firstTime, latest(_time) AS lastTime BY service_name 
|outputlookup previously_seen_running_windows_services 
|stats count

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

eventtype=wineventlog_system 

Search for Windows system events.

signature_id=7036

Search for a Windows service change to a state of running or stopped.

|rename param1 AS service_name
|rename param2 AS action
 

Rename the fields as shown for better readability.

|search action="running" 

Find services that are currently in the “running” state.

|stats earliest(_time) AS firstTime, latest(_time) AS lastTime BY service_name 

Find the first and last time each Windows service was in the running status and groups them by service.

|outputlookup previously_seen_running_windows_services 

Write the results to a new CSV lookup file, here called previously_seen_running_windows_services.

|stats count

Return a count for each instance.

Next steps

After you create this baseline, you can look for new Windows services that might indicate a threat.

For additional information about this search, such as its applicability to common frameworks and standards, see this project on GitHub.

You might also be interested in other processes associated with the Detecting techniques in the Orangeworm attack group use case.