Previously seen Windows service

You might want to collect the services that have been started across your entire enterprise when doing the following:

• Detecting techniques in the Orangeworm attack group

Prerequisites 

In order to execute this procedure in your environment, you may need to first on-board the data, services, or apps shown in the following table.

Example

The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source. 

New Windows services indicate new programs that might or might not be legitimate. You want to create a lookup file of known services that you can use to check against new ones found to decide if further investigation is necessary.

1. Ensure that your deployment is ingesting Windows security event logs. 
2. Run the following search: 

eventtype=wineventlog_system signature_id=7036 
|rename param1 AS service_name 
|rename param2 AS action 
|search action="running" 
|stats earliest(_time) AS firstTime, latest(_time) AS lastTime BY service_name 
|outputlookup previously_seen_running_windows_services 
|stats count

Search Explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

After you create this baseline, you can look for new Windows services that might indicate a threat.

For additional information about this search, such as its applicability to common frameworks and standards, see this project on GitHub.