Detection rules › Splunk

Windows Service Create RemComSvc

Author
Michael Haag, Splunk
Source
upstream

The following analytic detects the creation of the RemComSvc service on a Windows endpoint, typically indicating lateral movement using RemCom.exe. It leverages Windows EventCode 7045 from the System event log, specifically looking for the "RemCom Service" name. This activity is significant as it often signifies unauthorized lateral movement within the network, which is a common tactic used by attackers to spread malware or gain further access. If confirmed malicious, this could lead to unauthorized access to sensitive systems, data exfiltration, or further compromise of the network.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1543.003 Create or Modify System Process: Windows Service
Privilege EscalationT1543.003 Create or Modify System Process: Windows Service

Event coverage

ProviderEvent IDTitle
Service-Control-Manager7045

Stages and Predicates

Stage 1: search

search EventCode=7045 ServiceName="RemCom Service"

Stage 2: stats

stats BY dest, ImagePath, ServiceName, ServiceType

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 7045 corpus 12 (splunk 12)
ServiceNameeq
  • "RemCom Service"

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.