Procedure examples

Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.

StrongPity can install a service to execute itself as a service.

TinyTurla can install itself as a service on compromised machines.

Bad Rabbit drops a file named infpub.datinto the Windows directory and is executed through SCManager and rundll.exe.

Olympic Destroyer utilizes PsExec to help propagate itself across a network.

Mafalda can create a remote service, let it run once, and then delete it.

BlackByte 2.0 Ransomware executes as a service when deployed.

HOPLIGHT has used svchost.exe to execute a malicious DLL .

WastedLocker can execute itself as a service.

InvisiMole has used Windows services as a way to execute its malicious payload.

WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.

Okrum's loader can create a new service named NtmsSvc to execute the payload.

RemoteCMD can execute commands remotely by creating a new service on the remote system.

Ragnar Locker has used sc.exe to execute a service that it creates.

NotPetya can use PsExec to help propagate itself across a network.

HyperBro has the ability to start and stop a specified service.

Anchor can create and execute services to load its payload.

BBSRAT can start, stop, or delete services.

Clambling can create and start services on a compromised host.

DarkGate tries to elevate privileges to SYSTEM using PsExec to locally execute as a service, such as cmd /c c:\temp\PsExec.exe -accepteula -j -d -s [Target Binary].

LockBit 3.0 can use PsExec to execute commands and payloads.

Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.

Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.

Embargo has created a service named irnagentd that executed the MDeployer loader after the system is rebooted in Safe Mode.

gh0st RAT can execute its service if the Service key exists. If the key does not exist, gh0st RAT will create and run the service.

Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec.

Attor's dispatcher can be executed as a service.

HermeticWiper can create system services to aid in executing the payload.

Pysa has used PsExec to copy and execute the ransomware.

Pandora has the ability to install itself as a Windows service.

Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.

Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.

IPsec Helper is run as a Windows service in victim environments.

SysUpdate can manage services and processes.

ZxShell can create a new service for execution.

Winnti for Windows can run as a service using svchost.exe.

DEADWOOD can be executed as a service using various names, such as ScDeviceEnums.

LoudMiner started the cryptomining virtual machine as a service on the infected machine.

Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.

SLOTHFULMEDIA has the capability to start services.

HermeticWizard can use `OpenRemoteServiceManager` to create a service.

The net start and net stop commands can be used in Net to execute or stop Windows services.

Impacket contains various modules emulating other service execution tools such as PsExec.

Empire can use PsExec to execute a payload on a remote host.

PoshC2 contains an implementation of PsExec for remote execution.

xCmd can be used to execute binaries on remote systems by creating and starting a service.

Brute Ratel C4 can create Windows system services for execution.

Winexe installs a service on the remote system, executes the command, then uninstalls the service.

Koadic can run a command on another machine using PsExec.

Pupy uses PsExec to execute a payload or commands on a remote host.