AN0778
Analytic 0778
Windows
Monitor for abnormal creation or modification of Windows services (e.g., via sc.exe, PowerShell, or API calls) that load non-standard executables. Correlate registry changes in service keys with service creation events and process execution to detect service abuse for persistence or execution.
WinEventLog:Security
EventCode=4697
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=13, 14
[ServiceAllowlist]
Known good services and installers that regularly modify or create services
[TimeWindow]
Threshold for correlating service creation with unusual process execution
AN0779
Analytic 0779
Linux
Detect unusual invocations of systemctl, service, or init scripts creating or modifying daemons. Monitor audit logs for execution of binaries from unexpected paths linked to service start/stop activity.
auditd:SYSCALL
execve
linux:syslog
systemctl start/enable with uncommon binary paths
auditd:SYSCALL
write
[ServiceBinaryPaths]
Valid directories for service binaries to filter out benign changes
[UserContext]
Expected accounts performing service management (e.g., root/admin)
AN0780
Analytic 0780
macOS
Monitor launchd service definitions and property list (.plist) modifications for non-standard executables. Detect unauthorized processes registered as launch daemons or agents.
macos:unifiedlog
Unexpected processes registered with launchd
macos:unifiedlog
Modification of LaunchAgents or LaunchDaemons plist files
[PlistAllowlist]
Known launch agents/daemons expected to be modified by updates or IT tools
[PayloadEntropyThreshold]
Entropy level for detecting suspicious binary payloads in launchd services