Masquerade Task or Service

let SuspiciousServiceNames = dynamic(["Windows Update Security", "Microsoft Network Realtime", "Windows Advanced Task Manager", "Google Chrome Security Update", "Windows Video Service", "Windows Power Efficiency", "System Authorization Service", "Windows Management Help", "Microsoft Support", "Windows User Service"]);
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "ServiceInstalled"
| where AdditionalFields has_any (SuspiciousServiceNames)
   or AdditionalFields matches regex @"(?i)(svchost|update|security|microsoft|google|chrome|adobe|windows).*service"
| project Timestamp, DeviceName, AccountName, ActionType, AdditionalFields
| sort by Timestamp desc

(index=wineventlog sourcetype="WinEventLog:System" EventCode=7045)
OR (index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\services.exe")
| eval ServiceDisplayName=coalesce(ServiceName, ServiceDisplayName, param1)
| eval SuspiciousName=if(match(lower(ServiceDisplayName), "(windows update security|microsoft network realtime|windows advanced task|google chrome security|windows video service|windows power efficiency|system authorization|windows management help|microsoft support|windows user service)"), 1, 0)
| eval GenericMimic=if(match(lower(ServiceDisplayName), "(svchost|update|security|microsoft|google|chrome|adobe).*(service|task|helper|agent)"), 1, 0)
| where SuspiciousName=1 OR GenericMimic=1
| table _time, host, User, ServiceDisplayName, ServiceName, Image, CommandLine, ServiceType, StartType
| sort - _time

sequence by host.name with maxspan=5m
  [registry where registry.path : ("HKLM\\SYSTEM\\CurrentControlSet\\Services\\*") and
   registry.data.strings : ("*svchost*", "*update*", "*security*", "*microsoft*", "*google*", "*chrome*", "*adobe*") and
   registry.value : "ImagePath"]
  [process where event.type == "start" and process.parent.name : "services.exe"]

// Alternative flat query for service installation events:
process where event.type == "start" and
  process.parent.name : "services.exe" and
  (
    process.name : ("Windows Update Security*", "Microsoft Network Realtime*", "Windows Advanced Task Manager*",
                    "Google Chrome Security Update*", "Windows Video Service*", "Windows Power Efficiency*",
                    "System Authorization Service*", "Windows Management Help*", "Microsoft Support*",
                    "Windows User Service*") or
    process.args : ("*svchost*service*", "*update*service*", "*security*service*",
                    "*microsoft*service*", "*google*service*", "*chrome*service*", "*adobe*service*")
  )

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  LOGSOURCENAME(logsourceid) AS log_source,
  QIDNAME(qid) AS event_name,
  "ServiceName",
  "ServiceFileName",
  "ServiceType",
  "ServiceStartType",
  payload
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 45)
  AND (
    (eventid = 7045 AND (
      LOWER("ServiceName") MATCHES '(windows update security|microsoft network realtime|windows advanced task|google chrome security|windows video service|windows power efficiency|system authorization|windows management help|microsoft support|windows user service)'
      OR LOWER("ServiceName") MATCHES '(svchost|update|security|microsoft|google|chrome|adobe).*(service|task|helper|agent)'
    ))
    OR
    (eventid = 4697 AND (
      LOWER("ServiceName") MATCHES '(windows update security|microsoft network realtime|windows advanced task|google chrome security|windows video service|windows power efficiency|system authorization|windows management help|microsoft support|windows user service)'
      OR LOWER("ServiceName") MATCHES '(svchost|update|security|microsoft|google|chrome|adobe).*(service|task|helper|agent)'
    ))
  )
  AND DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') > DATEADD('hour', -24, NOW())
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=windows/system OR _sourceCategory=windows/security
| where EventID in ("7045", "4697")
| parse field=Message "Service Name: *" as ServiceName nodrop
| parse field=Message "Service File Name: *" as ServiceFileName nodrop
| parse field=Message "Account Name: *" as AccountName nodrop
| parse field=Message "Service Type: *" as ServiceType nodrop
| parse field=Message "Start Type: *" as StartType nodrop
| where (
    matches(toLowerCase(ServiceName), ".*windows update security.*") or
    matches(toLowerCase(ServiceName), ".*microsoft network realtime.*") or
    matches(toLowerCase(ServiceName), ".*windows advanced task.*") or
    matches(toLowerCase(ServiceName), ".*google chrome security.*") or
    matches(toLowerCase(ServiceName), ".*windows video service.*") or
    matches(toLowerCase(ServiceName), ".*windows power efficiency.*") or
    matches(toLowerCase(ServiceName), ".*system authorization service.*") or
    matches(toLowerCase(ServiceName), ".*windows management help.*") or
    matches(toLowerCase(ServiceName), ".*microsoft support.*") or
    matches(toLowerCase(ServiceName), ".*windows user service.*") or
    matches(toLowerCase(ServiceName), ".*(svchost|update|security|microsoft|google|chrome|adobe).*(service|task|helper|agent).*")
  )
| fields _messageTime, Computer, AccountName, ServiceName, ServiceFileName, ServiceType, StartType, EventID
| sort by _messageTime desc

rule masquerade_task_or_service_t1036_004 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects installation of Windows services with names mimicking legitimate Microsoft, Google, or Adobe services — MITRE ATT&CK T1036.004"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1036.004"
    reference = "https://attack.mitre.org/techniques/T1036/004/"
    false_positives = "Legitimate enterprise software with generic service names"

  events:
    $e.metadata.event_type = "SERVICE_MODIFICATION"
    $e.metadata.product_name = "Microsoft-Windows-Security-Auditing"
    (
      re.regex($e.target.resource.name,
        `(?i)(windows update security|microsoft network realtime|windows advanced task manager|google chrome security update|windows video service|windows power efficiency|system authorization service|windows management help|microsoft support|windows user service)`
      )
      or
      re.regex($e.target.resource.name,
        `(?i)(svchost|update|security|microsoft|google|chrome|adobe).*(service|task|helper|agent)`
      )
    )

  condition:
    $e
}

// CrowdStrike LogScale (Falcon) — Masqueraded Service Installation T1036.004
#event_simpleName = ServiceInstall
| regex(field=ServiceDisplayName, regex="(?i)(windows update security|microsoft network realtime|windows advanced task manager|google chrome security update|windows video service|windows power efficiency|system authorization service|windows management help|microsoft support|windows user service)", as=KnownSuspiciousName)
| regex(field=ServiceDisplayName, regex="(?i)(svchost|update|security|microsoft|google|chrome|adobe).*(service|task|helper|agent)", as=GenericMimicName)
| where KnownSuspiciousName = true OR GenericMimicName = true
| table([timestamp, ComputerName, UserName, ServiceDisplayName, ServiceImagePath, ServiceObjectName, ServiceType, ServiceStartType])
| sort(timestamp, order=desc)

// Alternative: catch masquerade via process ancestry (services.exe spawning unexpected children)
// #event_simpleName = ProcessRollup2
// | where ParentBaseFileName = "services.exe"
// | regex(field=ImageFileName, regex="(?i)(windows update|microsoft network|google chrome|system authorization|windows management)", as=MimickedBinary)
// | where MimickedBinary = true
// | groupBy([ComputerName, UserName, ImageFileName, CommandLine], function=count())