Skip to content

SERVICE_DETECTION_METHODS.md

Latest commit

 

History

History
202 lines (152 loc) · 5.71 KB

SERVICE_DETECTION_METHODS.md

File metadata and controls

202 lines (152 loc) · 5.71 KB
Raw

Service Detection Methods

How the System Detects Normal vs Abnormal Services

The Malware Defense system uses multiple layers of detection to identify malicious or suspicious Windows services:

1. Known Malicious Service Blacklist (Score: 90)

Services with names matching known malware/hacking tools:

  • PSEXESVC - PsExec remote execution (commonly abused by malware)
  • RemoteAccess - Generic remote access service
  • Backdoor - Obvious backdoor service
  • RAT - Remote Access Trojan
  • Miner/Cryptominer - Cryptocurrency mining services

Detection: Exact name match (case-insensitive)

2. Suspicious Keyword Detection (Score: 60-95)

Services containing suspicious keywords in their name or display name:

Keyword Score Description
rootkit 95 Rootkit malware
ransom 95 Ransomware
backdoor 90 Backdoor access
trojan 90 Trojan malware
botnet 90 Botnet component
psexe 85 PsExec variants
keylog 85 Keylogger
stealer 85 Information stealer
worm 85 Worm malware
cryptominer 80 Crypto miner
dropper 80 Malware dropper
injector 75 Code injector
hack 75 Hacking tool
miner 70 Crypto miner
rat 70 Remote access trojan
crack 70 Cracking tool
bypass 65 Security bypass
remoteaccess 60 Remote access
loader 60 Malware loader

Detection: Substring match in service name or display name

3. Digital Signature Verification (Score: 40-50)

Unsigned Binary in System Directory (Score: 50)

  • Service binary located in C:\Windows\System32 or C:\Windows\SysWOW64
  • Binary is NOT digitally signed
  • Why suspicious: All legitimate Windows system services are Microsoft-signed

Non-Microsoft Signed in System Directory (Score: 45)

  • Service binary in Windows system directories
  • Binary is signed but NOT by Microsoft
  • Why suspicious: Third-party services shouldn't install in system directories

Unsigned Binary Anywhere (Score: varies)

  • Service binary is not digitally signed
  • Lower score if in normal program directories
  • Why suspicious: Legitimate software publishers sign their binaries

4. Service Binary Location Analysis (Score: 35-45)

Suspicious Locations:

  • Windows System Directories (C:\Windows\*) - Non-Microsoft services shouldn't be here
  • Temp Directories - Malware often runs from temp folders
  • User AppData - Unusual location for system services

Normal Locations:

  • C:\Program Files\ - Standard application directory
  • C:\Program Files (x86)\ - 32-bit applications
  • Vendor-specific directories with proper signatures

5. Random Service Name Detection (Score: 35)

Detects randomly-generated service names common in malware:

Characteristics:

  • Very few vowels (< 20% of letters)
  • High digit-to-letter ratio (> 30% digits)
  • All uppercase/lowercase with numbers (e.g., "SVC123XYZ", "svc789abc")

Examples:

  • XQZRT123 - Random consonants + numbers
  • SVC8F3D2A - Service prefix + hex-like string
  • WNDPRCSVC99 - Few vowels, many consonants

Why suspicious: Legitimate services have meaningful names (e.g., "Windows Update", "Print Spooler")

6. Missing Service Description (Score: 15)

  • Service has no display name
  • Display name is identical to service name
  • Why suspicious: Legitimate services always have descriptive display names

7. Missing Binary File (Score: 30)

  • Service is registered but binary file doesn't exist
  • Why suspicious: Service may have been partially removed or is malformed

Threat Level Scoring

Total scores are calculated by adding all indicator scores:

Score Range Threat Level Action
0-29 Clean No action
30-49 Suspicious Log and monitor
50-79 Malicious Alert user, recommend removal
80+ Critical Alert user, automatic containment

Examples

Example 1: PSEXESVC (Critical - Score: 90+)

Service Name: PSEXESVC
Binary: C:\Windows\PSEXESVC.exe
Indicators:
  - Known malicious service (90 points)
  - Unsigned binary in Windows directory (50 points)
Total Score: 140 → CRITICAL

Example 2: Legitimate Service (Clean - Score: 0)

Service Name: wuauserv
Display Name: Windows Update
Binary: C:\Windows\System32\svchost.exe
Signed: Yes (Microsoft Corporation)
Total Score: 0 → CLEAN

Example 3: Suspicious Service (Malicious - Score: 60)

Service Name: RemoteHelper
Binary: C:\Users\Public\helper.exe
Indicators:
  - Suspicious keyword "remote" (60 points)
  - Unsigned binary (varies)
Total Score: 60+ → MALICIOUS

Example 4: Random Name Service (Suspicious - Score: 35)

Service Name: XQZRT123
Binary: C:\ProgramData\xqzrt.exe
Indicators:
  - Random service name (35 points)
  - No description (15 points)
Total Score: 50 → MALICIOUS

How to Use

When you run a scan:

  1. Quick Scan - Scans all running services + critical system files
  2. Full Scan - Scans all services + all drives
  3. Custom Scan - Scans services + selected folders

The scanner will:

  • Check all running Windows services
  • Apply all detection methods above
  • Report any service with score ≥ 30
  • Provide detailed threat information
  • Recommend actions (monitor, quarantine, remove)

False Positives

To minimize false positives:

  • Microsoft-signed services are trusted
  • Well-known legitimate services are whitelisted
  • Multiple indicators required for high scores
  • Context matters (location + signature + name)

If a legitimate service is flagged:

  • Check if it's properly signed
  • Verify the publisher
  • Check if it's installed in the correct location
  • Report false positive for whitelist consideration