StoneDrill Service Installation Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•12•0•25

This rule detects the installation of a Windows service named 'NtsSrv' with an ImagePath ending in ' LocalService'. This specific service name and image path pattern are associated with the StoneDrill wiper malware, as described in Kaspersky's research.