high EQL Windows

Service Installed From a User-Writable Path

A new Windows service whose binary lives in Temp, AppData or a public folder. Persistence and privilege escalation in a single event.

Rule source

service-created-from-temp-path.eql

/* Service Installed From a User-Writable Path
   T1543.003 - Create or Modify System Process: Windows Service
   Persistence and privilege escalation in a single event. */

sequence by host.name with maxspan=5m
  [ any where event.code == "7045" and
      winlog.event_data.ImagePath : (
        "*\\AppData\\Local\\Temp\\*",
        "*\\Windows\\Temp\\*",
        "*\\Users\\Public\\*",
        "*\\ProgramData\\*"
      ) and
      not winlog.event_data.ServiceName : (
        "ScreenConnect*",
        "TeamViewer*",
        "NinjaRMMAgent"
      )
  ]
  [ process where event.type == "start" and
      process.parent.name == "services.exe"
  ]

Required telemetry

Windows System log - Event ID 7045, or Elastic Endpoint service events

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Installers that stage a service binary before relocating it
Remote-support tools - allowlist by signer

Validation

Atomic Red Team T1543.003-1; confirm the 7045 channel is actually forwarded

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.