Skip to main content
Splunk Lantern

First time seen Windows service

You might want to look for the first time a Windows service is seen running in your environment when doing the following:

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

Example

New Windows services indicate new programs that might or might not be legitimate. You want to compare new services against ones that have already occurred on your network to decide if further investigation is necessary.

To optimize the search shown below, you should specify an index and a time range.

  1. Ensure that your deployment is ingesting Windows security event logs. 
  2. Run the support search, previously seen Windows service, before this search to create the baseline of known Windows services. 
  3. Run the following search: 
eventtype=wineventlog_system signature_id=7036 
|rename param1 AS service_name 
|rename param2 AS action 
|search action="running" [ search eventtype=wineventlog_system signature_id=7036 | rename param1 AS service_name |rename param2 as action |search action="running" |stats earliest(_time) AS firstTime, latest(_time) AS lastTime by service_name |inputlookup append=t previously_seen_running_windows_services |stats min(firstTime) as firstTime max(lastTime) AS lastTime BY service_name |outputlookup previously_seen_running_windows_services |eval serviceStatus=if(firstTime >= relative_time(now(),"-60m@m"), "First time seen Windows service","Previously seen Windows service") |where serviceStatus="First time seen Windows service"| |convert timeformat="%m/%d/%Y %H:%M:%S" ctime(firstTime) |convert timeformat="%m/%d/%Y %H:%M:%S" ctime(lastTime) |table service_name]
|table _time dest service_name

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

eventtype=wineventlog_system 

Search for Windows system events.

signature_id=7036

Search for a Windows service change to a state of running or stopped.

|rename param1 AS service_name
|rename param2 AS action

Rename the fields as shown for better readability.

|search action="running" [ search eventtype=wineventlog_system signature_id=7036 |rename param1 AS service_name |rename param2 as action |search action="running" |stats earliest(_time) AS firstTime, latest(_time) AS lastTime by service_name |inputlookup append=t previously_seen_running_windows_services | stats min(firstTime) as firstTime max(lastTime) AS lastTime BY service_name |outputlookup previously_seen_running_windows_services|eval serviceStatus=if(firstTime >= relative_time(now(),"-60m@m"), "First time seen Windows service","Previously seen Windows service") |where serviceStatus="First time seen Windows service"|convert timeformat="%m/%d/%Y %H:%M:%S" ctime(firstTime) |convert timeformat="%m/%d/%Y %H:%M:%S" ctime(lastTime) |table service_name]

Search for a change in the status of a Windows service, then extract the name of the service and the action taken by the service. Add the cache file of previously seen Windows services to the search. Update the cache file with the latest information and search for services that have never before been seen.


 

|table _time dest service_name

Display the results in a table with columns in the order shown.

Result

A previously unseen service is not necessarily malicious. Verify that the service is legitimate and that was installed by a legitimate process. It is uncommon that new services are spawned in a standard environment. Investigate web and authentication activity on the destination. If you have the Splunk Enterprise Security app, you can leverage the Threat Intel Framework to watch for traffic from known malicious IP addresses.

For additional information about this search, such as its applicability to common frameworks and standards, see this project on GitHub.

  • Was this article helpful?