Procedure examples

TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.

Ninja can create the services `httpsvc` and `w3esvc` for persistence .

Wiarp creates a backdoor through which remote attackers can create a service.

The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV.”

Stuxnet uses a driver registered as a boot start service as the main load-point.

If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.

Emissary is capable of configuring itself as a service.

Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.

ThreatNeedle can run in memory and register its payload as a Windows service.

ZLib creates Registry keys to allow itself to run as various services.

Bankshot can terminate a specific process by its process id.

StrongPity has created new services and modified existing services for persistence.

Nebulae can create a service to establish persistence.

AuditCred is installed as a new service on the system.

TONESHELL has created a malicious service DISMsrv to maintain persistence.

Hannotog creates a new service for persistence.

Medusa Ransomware has created a new PowerShell process using the `CreateProcessA` API.

RainyDay can use services to establish persistence.

BOOKWORM has created a service named `Microsoft Windows DeviceSync Service` at `HKLM\SYSTEM\CurrentControlSet\Services\DeviceSync\` to trigger execution when the system starts and to maintain persistence.

CosmicDuke uses Windows services typically named "javamtsup" for persistence.

GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.

Emotet has been observed creating new services to maintain persistence.

TEARDROP ran as a Windows service from the c:\windows\syswow64 folder.

DUSTPAN can persist as a Windows Service in operations.

PingPull has the ability to install itself as a service.

SUGARUSH has created a service named `Service1` for persistence.

WastedLocker created and established a service that runs until the encryption process is complete.

InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.

Naid creates a new service to establish.

Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.

ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.

RDAT has created a service when it is installed on the victim machine.

To establish persistence, Okrum can install itself as a new service named NtmSsvc.

Kazuar can install itself as a new service.

Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.

One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.

zwShell has established persistence by adding itself as a new service.

DCSrv has created new services for persistence by modifying the Registry.

ShimRat has installed a Windows service to maintain persistence on victim machines.

Conficker copies itself into the %systemroot%\system32 directory and registers as a service.

KeyBoy installs a service pointing to a malicious DLL dropped to disk.

Anchor can establish persistence by creating a service.

SplatDropper has created a service to execute a payload.

Dyre registers itself as a service by adding several Registry keys.

BBSRAT can modify service configurations.

PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.

Reaver installs itself as a new service.

Bisonal has been modified to be used as a Windows service.

Cuba can modify services by using the OpenService and ChangeServiceConfig functions.

Clambling can register itself as a system service to gain persistence.