Execution Modality: Detecting Windows Service Creation Beyond sc.exe

What Happened

Malicious actors now create Windows services using multiple modalities—sc.exe, PowerShell, direct RPC calls, or indirect registry writes—bypassing traditional event‑log detection. Elastic has identified that the registry is the OS source of truth for service configuration, but many tools manipulate it without triggering logs.

Impact

Defenders relying solely on sc.exe command‑line or event‑log alerts miss service installs performed via direct RPC, syscalls, or Remote Registry updates. This leads to undetected persistence and lateral movement.

What to Do

• Enable Elastic’s configuration‑manager callback monitoring to capture all service‑creation events at the kernel level.
• Collect and correlate RPC calls to Service Control Manager (services.exe) and Remote Registry activity.
• Implement baseline checks on the Services registry hive (HKLM\SYSTEM\CurrentControlSet\Services) and alert on anomalous entries.
• Use PowerShell logging (module load, script block logging) to surface hidden service‑creation scripts.
• Validate any new service against known benign installers and whitelist trusted utilities.

Additional Considerations

Because kernel‑level monitoring can reduce context, pair low‑level callbacks with higher‑level telemetry to maintain visibility into the attacker’s intent and chain of execution.