MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1543.003Windows Service

PersistencePrivilege Escalation

View on MITRE ATT&CK →

1 Query

Windows Service Created via sc.exe or PowerShell

mediumtestingDefender XDR

Microsoft Defender for Endpoint·DeviceProcessEvents

DeviceProcessEvents
| where Timestamp > ago(1d)
| where (FileName =~ "sc.exe" and ProcessCommandLine has "create" and ProcessCommandLine has "binPath")
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "New-Service")
| where ProcessCommandLine !has_any ("Microsoft", "Windows", "ProgramData\\Microsoft")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc

Microsoft (adapted) · last tested 2025-03-01

Tuning notes

Software installers (MSI) create services legitimately. Exclude known installer paths and expand the Microsoft/Windows exclusion list based on your software baseline.

+ Add another query for this technique →