Sunturai
Back to results
MediumSplunk security contentMichael Haag +1

Services Escalate Exe

The following analytic identifies the execution of a randomly named binary via `services.exe`, indicative of privilege escalation using Cobalt Strike's `svc-exe`. This detection leverages data from Endpoint Detection…

Description

The following analytic identifies the execution of a randomly named binary via `services.exe`, indicative of privilege escalation using Cobalt Strike's `svc-exe`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process lineage and command-line executions. This activity is significant as it often follows initial access, allowing adversaries to escalate privileges and establish persistence. If confirmed malicious, this behavior could enable attackers to execute arbitrary code, maintain long-term access, and potentially move laterally within the network, posing a severe threat to the organization's security.

Detection logic

Detection requirements

Platform
IaaSIdentity ProviderLinuxmacOSOffice SuiteWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
crowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • False positives should be limited as `services.exe` should never spawn a process from `ADMIN$`. Filter as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice