Service registered with an image path in a user-writable directory

1title: Service registered with an image path in a user-writable directory2id: 559b945a-36fd-43d2-805c-ef532569d74b3status: experimental4description: |5  Anchors on the same Security 4697 service-creation record as the published6  T1569.002 rule, but on a different field pattern, which is what keeps the two7  from collapsing into one analytic. T1569.002 matches ServiceFileName being a8  shell, script host or UNC path — the signature of a tool that abuses the9  service mechanism to execute something once and move on. This rule matches10  MITRE's ImagePathFilter knob instead, populated here with a broader set of11  writable-directory paths than MITRE's own worked example: MITRE's12  mutableElements entry names only `C:\Users\` and `C:\Temp\` directly (the13  `\Temp\` term below is written to catch that literal path and, as a side14  effect, `\Windows\Temp\` too); the additional ServiceFileName terms for15  `\ProgramData\` and the recycle bin are this rule's own extension of that16  pattern to other locations that are user-writable but atypical for a17  service image path, regardless of what kind of binary it is — the18  signature of a service meant to persist, staged somewhere services do not19  normally live because the adversary has no Program Files-style install20  path to drop into. A legitimate-looking,21  correctly-signed executable registered this way still matches; a22  shell-launching service registered from a normal install path does not, and23  is exactly what T1569.002 is for instead. The command-line and driver-load24  legs of AN1527 (`sc.exe`/PowerShell invocation, `.sys` loads via25  `ZwLoadDriver`) are separate events this rule does not join to the creation26  record, and MITRE's UnsignedBinaryAlert and ServiceNamePattern knobs need27  signature status and a name baseline this log source does not carry. 469728  requires the Audit Security System Extension (Success) subcategory, which is29  off in a default install and in the MS and CIS baselines — without it this30  rule is blind, not quiet.31  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0552, not hand-written and not tested by its author. Any lab result is on this rule's own page.32references:33  - https://attack.mitre.org/techniques/T1543/00334  - https://attack.mitre.org/detectionstrategies/DET055235author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)36date: 2026-08-1637tags:38  - attack.persistence39  - attack.privilege-escalation40  - attack.t1543.00341logsource:42  product: windows43  service: security44detection:45  selection:46    EventID: 469747    ServiceFileName|contains:48      - '\Users\'49      - '\Temp\'50      - '\ProgramData\'51      - '\$Recycle.Bin\'52  condition: selection53falsepositives:54  - "Consumer and line-of-business software that stages a background helper or update service under %ProgramData%\\<vendor>\\ instead of Program Files — printer and OEM utilities, cloud-sync backends and some security suites all do this by design, and it is likely the largest source of matches on a typical fleet."55  - "IT-run remote-support and diagnostic tools that register a temporary service pointing at a binary copied into a technician's profile or %TEMP% for the duration of a single session."56  - "Application self-updaters that stage the next version's executable under %ProgramData% during an upgrade and re-point the existing service at it before the old file is cleaned up."57  - "Endpoint-security or backup agents whose repair, quarantine or recovery component is deliberately installed from a %ProgramData% cache directory rather than the product's main install path."58level: medium