Sigma rule for Zeek - Detects when a Windows service has been changed or started with svcctl remotely (using DCE/RPC).

zeek_svcctl.yaml

title: Windows service changed or started remotely with svcctl
status: experimental
description: Detects when a Windows service has been changed or started with svcctl remotely (using DCE/RPC). 
references:
    - https://github.com/juliourena/SharpNoPSExec
author: 'Josh Brower, @Defensivedepth'
logsource:
    product: zeek
    service: dce_rpc
detection:
    selection:
        endpoint: svcctl
        operation: 
            - ChangeServiceConfigW
            - StartServiceA
    #filter:
        #src_ip:
            #- x.x.x.x
    condition: selection #and not filter
falsepositives:
    - Legit administrative activity
fields:
    - src_ip
level: high