T1543.003 Windows Service — ATT&CK Technique
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API. Adversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via Native API functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. Modify Registry), or by using command-line utilities such as `PnPUtil.exe`. Adversaries may leverage these drivers as Rootkits to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of Exploitation for Privilege Escalation. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through Service Execution. To make detection analysis more challenging, malicious services may also incorporate Masquerade Task or Service (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create ‘hidden’ services (i.e., Hide Artifacts), for example by using the `sc sdset` command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as `Get-Service`, `sc query`, and `services.exe`.
Detection coverage (50)
- PUA - Kernel Driver Utility (KDU) Execution high
- Special File Creation via Mknod Syscall low
- CobaltStrike Service Installations - Security high
- Remote Access Tool Services Have Been Installed - Security medium
- New PDQDeploy Service - Server Side medium
- Service Installation in Suspicious Folder medium
- CobaltStrike Service Installations - System critical
- New PDQDeploy Service - Client Side medium
- Sliver C2 Default Service Installation high
- Moriya Rootkit - System critical
- Remote Access Tool Services Have Been Installed - System medium
- ProcessHacker Privilege Elevation high
- Suspicious Service Installation high
- Uncommon Service Installation Image Path medium
- Service Installation with Suspicious Folder Pattern high
- Driver Load From A Temporary Directory high
- Suspicious Service Installation Script high
- Vulnerable Driver Load high
- Malicious Driver Load By Name medium
- Vulnerable WinRing0 Driver Load high
- Malicious Driver Load high
- Vulnerable HackSys Extreme Vulnerable Driver Load high
- Vulnerable Driver Load By Name low
- PSEXEC Remote Execution File Artefact high
- Devcon Execution Disabling VMware VMCI Device high
- New Service Creation Using PowerShell low
- Suspicious Service DACL Modification Via Set-Service Cmdlet high
- New Service Creation Using Sc.EXE low
- Deny Service Access Using Security Descriptor Tampering Via Sc.EXE high
- Suspicious Service Path Modification high
- Allow Service Access Using Security Descriptor Tampering Via Sc.EXE high
- Potential Persistence Attempt Via Existing Service Tampering medium
- New Kernel Driver Via SC.EXE medium
- Suspicious New Service Creation high
- Sysinternals PsService Execution medium
- Sysinternals PsSuspend Execution medium
- Potential CobaltStrike Service Installations - Registry high
- ServiceDll Hijack medium
- Turla PNG Dropper Service critical
- CMD Echo Pipe - Escalation
- Impacket Lateral Movement smbexec CommandLine Parameters
- Impacket Lateral Movement Commandline Parameters
- Impacket Lateral Movement WMIExec Commandline Parameters
- Possible Lateral Movement PowerShell Spawn
- Randomly Generated Windows Service Name
- Services LOLBAS Execution Process Spawn
- Windows Admin Password Changed by Non-Admin
- Windows Bluetooth Service Installed From Uncommon Location
- Windows Cloud Files Filter Loaded by Uncommon Process
- Windows KrbRelayUp Service Creation
Malware using this technique
- TrickBot
- Ninja
- Wiarp
- Exaramel for Windows
- Stuxnet
- PipeMon
- TDTESS
- Emissary
- Ursnif
- ThreatNeedle
- ZLib
- ShimRat
- Bankshot
- StrongPity
- Nebulae
- AuditCred
- TONESHELL
- Hannotog
- Medusa Ransomware
- RainyDay
- StreamEx
- BOOKWORM
- CosmicDuke
- GreyEnergy
- Emotet
- TEARDROP
- DUSTPAN
- Clambling
- PingPull
- SUGARUSH
- WastedLocker
- InvisiMole
- Naid
- Volgmer
- ZeroT
- RDAT
- Okrum
- Kazuar
- Ragnar Locker
- BlackEnergy
- zwShell
- DCSrv
- Conficker
- KeyBoy
- Anchor
- SplatDropper
- Dyre
- BBSRAT
- PlugX
- Reaver