Product
high
advisory
Windows Service Installed via an Unusual Client for Privilege Escalation
2 rules 1 TTPIdentifies the creation of a Windows service by an unusual client process, which can be leveraged to escalate privileges from administrator to SYSTEM by exploiting misconfigurations or vulnerabilities in the service creation process.
VeeamVssSupport +6
privilege-escalation
windows-service
windows
2r
1t
medium
advisory
Detecting Remote Windows Service Installation for Lateral Movement
2 rules 3 TTPsThis rule detects a network logon followed by Windows service creation with the same LogonId on a Windows host, which could indicate lateral movement or persistence by adversaries.
Windows +4
lateral-movement
persistence
2r
3t