Adversaries may use service hollowing to execute malicious code under the guise of legitimate services, establishing persistence by replacing or injecting malicious payloads into service configurations. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect stealthy persistence mechanisms that evade traditional detection methods.
YARA Rule
rule dragos_crashoverride_serviceStomper {
meta:
description = "Identify service hollowing and persistence setting"
author = "Dragos Inc"
reference = "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
strings:
$s0 = { 33 c9 51 51 51 51 51 51 ?? ?? ?? }
$s1 = { 6a ff 6a ff 6a ff 50 ff 15 24 ?? 40 00 ff ?? ?? ff 15 20 ?? 40 00 }
condition:
all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 2 string patterns in its detection logic.
Scenario: Scheduled Task for System Maintenance
Description: A legitimate scheduled task is configured to run a maintenance script that temporarily creates a service with a benign executable.
Filter/Exclusion: process.parent_process_name:"Task Scheduler" or process.parent_process_path:"C:\\Windows\\System32\\schtasks.exe"
Scenario: Service Installation via Group Policy
Description: An IT administrator uses Group Policy to deploy a service that is installed and configured through a script or MSI package.
Filter/Exclusion: process.parent_process_name:"gpupdate.exe" or process.parent_process_path:"C:\\Windows\\System32\\gpupdate.exe"
Scenario: Service Creation for Application Deployment
Description: A deployment tool like Chocolatey or WSUS creates a temporary service during software installation.
Filter/Exclusion: process.parent_process_name:"choco.exe" or process.parent_process_name:"wuauclt.exe"
Scenario: Service Hollowing for Debugging Purposes
Description: A developer uses Process Explorer or Procmon to hollow a service for debugging or testing.
Filter/Exclusion: process.parent_process_name:"procmon.exe" or process.parent_process_name:"procexp.exe"
Scenario: Service Persistence via Registry Task Scheduler
Description: An admin configures a registry-based task using reg.exe or regedit.exe to persist a service.
Filter/Exclusion: process.parent_process_name:"reg.exe" or process.parent_process_name:"regedit.exe"