Suspicious Windows Service Installation Detected

Google SecOps@GoogleSecOps

•updated Apr 17, 2025•1•0•39

This detection rule identifies the creation of a Windows service with a suspicious or known malicious name, as logged by Windows Event ID 7045 (`A service was installed in the system`). Threat actors often create services to achieve persistence, lateral movement, remote execution, or privilege escalation. Detection of such activity is critical for identifying early-stage post-compromise behavior.