win_system_service_install_remote_utilities.yml

title: Remote Utilities Host Service Install
id: 85cce894-dd8b-4427-a958-5cc47a4dc9b9
status: test
description: Detects Remote Utilities Host service installation on the target system.
references:
    - https://www.remoteutilities.com/support/kb/host-service-won-t-start/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022/10/31
tags:
    - attack.persistence
logsource:
    product: windows
    service: system
detection:
    # Example:
    #   <EventData>
    #       <Data Name="ServiceName">Remote Utilities - Host</Data>
    #       <Data Name="ImagePath">"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service</Data>
    #       <Data Name="ServiceType">user mode service</Data>
    #       <Data Name="StartType">auto start</Data>
    #       <Data Name="AccountName">LocalSystem</Data>
    #   </EventData>
    selection_root:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection_service:
        - ImagePath|contains|all:
              - '\rutserv.exe'
              - '-service'
        - ServiceName: 'Remote Utilities - Host'
    condition: all of selection_*
falsepositives:
    - Legitimate use of the tool
level: medium