MELTr
Home Vendors Search Download
Login
Vendors / Microsoft Corporation / Windows / CLOP Ransomware Service Installation
Microsoft Corporation logo

Event type

CLOP Ransomware Service Installation

Known CLOP Persistence Mechanism - Event ID 7045

CLOP Ransomware Service Installation - Known persistence mechanism used by CLOP ransomware family

XML 13 fields Low Generator

clop ransomware persistence t1543 malware threat-simulation
Preview Sample View Schema
CLI Install
meltr templates install microsoft

Overview

What this event covers

Simulates CLOP ransomware service installation events. CLOP is a sophisticated ransomware family that uses specific service names ('SecurityCenterIBM', 'WinCheckDRVs') for persistence and privilege escalation. This template generates events matching known CLOP TTPs for detection rule testing and SOC training.

When generated

  • ›During CLOP ransomware deployment phase
  • ›For persistence establishment on compromised Windows systems
  • ›In red team exercises simulating CLOP campaign tactics
  • ›For detection rule validation and SOC analyst training

Security relevance

Critical

Compliance

MITRE ATT&CK T1543.003 (Create or Modify System Process: Windows Service) NIST Cybersecurity Framework - Detect (DE.CM) SANS TOP 20 Critical Security Controls PCI DSS Requirement 10 (Logging and Monitoring)

Frequency notes

Very low frequency in legitimate environments - any occurrence should trigger immediate investigation

Resources

Docs and tools

Mandiant CLOP Ransomware Analysis reference VirusTotal CLOP Ransomware Deep Dive community MITRE ATT&CK - T1543.003 Windows Service reference Splunk CLOP Detection Rule community Windows Event ID 7045 Reference reference Splunk Enterprise Security Primary SIEM platform for CLOP detection and response Sysmon Enhanced Windows logging for detailed process and service monitoring YARA Rules for CLOP Pattern matching rules for CLOP ransomware identification Windows Defender ATP Microsoft's endpoint detection and response platform

Generation

Configuration

Base frequency
0.2 events/hour
Time patterns
business_hours night_hours weekend
Business hours
1.5x
Night hours
2.0x
Weekend
1.8x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

Provider
Object Required

Event provider information - always Service Control Manager for Event ID 7045

Source: Static values for Service Control Manager

Example {"Name": "Service Control Manager", "Guid": "{555908d1-a6d7-4695-8e1e-26931d2012f4}"}
EventID
Integer Required

Windows Event ID - always 7045 for service installation

Source: Static value 7045

Example 7045
TimeCreated
DateTime Required

Timestamp when the service was installed

Source: current_timestamp() | iso8601_utc

Format xs:dateTime, UTC with a single Z
Example 2024-03-04T04:38:23.109986Z
EventRecordID
Integer Required

Unique record identifier for this event log entry

Source: random_int(100000, 999999)

Example 168102
ProcessID
Integer Required

Process ID of the Service Control Manager process

Source: random_int(500, 2000)

Example 592
ThreadID
Integer Required

Thread ID within the Service Control Manager process

Source: random_int(600, 1000)

Example 688
Computer
String Required

Hostname/FQDN of the computer where service was installed

Source: registry.get_random_device().hostname | default(random_hostname())

Example ar-win-dc.attackrange.local
UserID
String Optional

SID of the logging principal, included only when the entity supplies one. A missing or null SID omits UserID.

Source: registry user sid when it starts with S-1-. Otherwise <Security/>.

Format Windows SID format
Example S-1-5-18
ServiceName
String Required

CLOP ransomware uses specific service names for persistence

Source: random_choice(['SecurityCenterIBM', 'WinCheckDRVs'])

Example SecurityCenterIBM
Values
  • SecurityCenterIBM Primary CLOP ransomware service name - mimics legitimate security software
  • WinCheckDRVs Secondary CLOP ransomware service name - appears to be driver checking utility
ImagePath
String Required

CLOP often uses suspicious executable paths or system utilities for living-off-the-land attacks

Source: random_choice() weighted toward CLOP-typical paths

Example cmd.exe
Values
  • cmd.exe Direct command execution - classic CLOP tactic for initial payload execution
  • C:\Temp\*.exe Temporary directory execution - common staging area for CLOP payloads
  • C:\Windows\System32\*.exe System masquerading - CLOP attempts to blend with legitimate system processes
ServiceType
String Required

Type of Windows service being installed, using the English Event 7045 strings

Source: user mode service, kernel mode driver, or file system driver

Example user mode service
Values
  • user mode service Win32 service. StartType is auto start, demand start, or disabled.
  • kernel mode driver Kernel driver. May use boot start or system start.
  • file system driver File system driver. May use boot start or system start.
StartType
String Required

Service startup configuration. boot start and system start are only emitted for drivers.

Source: Paired to ServiceType. User-mode services use auto start, demand start, or disabled.

Example auto start
Values
  • auto start Starts automatically. Valid for services and drivers.
  • demand start Starts when requested. Valid for services and drivers.
  • disabled Service is disabled. Valid for services and drivers.
  • boot start Loaded by the boot loader. Drivers only.
  • system start Loaded during kernel initialization. Drivers only.
AccountName
String Required

Account under which the service will run

Source: random_choice() from service accounts

Example LocalSystem
Values
  • LocalSystem Highest privilege system account
  • LocalService Limited system account
  • NetworkService Network-capable limited account