Procedure examples

Kwampirs creates a new service named WmiApSrvEx to establish persistence.

Nerex creates a Registry subkey that registers a new service.

Some InnaputRAT variants create a new Windows service to establish persistence.

ZxShell can create a new service using the service parser function ProcessScCommand.

Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.

AppleJeus can install itself as a service.

STARWHALE has the ability to create the following Windows service to establish persistence on an infected host: `sc create Windowscarpstss binpath= "cmd.exe /c cscript.exe c:\\windows\\system32\\w7_1.wsf humpback_whale" start= "auto" obj= "LocalSystem"`.

Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.

One persistence mechanism used by CozyCar is to register itself as a Windows service.

QakBot can remotely create a temporary service on a target host.

Gelsemium can drop itself in `C:\Windows\System32\spool\prtprocs\x64\winprint.dll` as an alternative Print Processor to be loaded automatically when the spoolsv Windows service starts.

Dtrack can add a service called WBService to establish persistence.

LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.

BitPaymer has attempted to install itself as a service to maintain persistence.

SLOTHFULMEDIA has created a service on victim machines named "TaskFrame" to establish persistence.

FALLCHILL has been installed as a Windows service.

SILENTTRINITY can establish persistence by creating a new service.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.

Empire can utilize built-in modules to modify service binaries and restore them to their original state.

Remcos can terminate, suspend, and resume a process by PID.

PsExec can leverage Windows services to escalate privileges from administrator to SYSTEM with the -s argument.

Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.

COATHANGER will create a daemon for timed check-ins with command and control infrastructure.

Dacls can establish persistence via a Launch Daemon.

The REPTILE launcher can daemonize a process.

Green Lambert can add a plist file in the `Library/LaunchDaemons` to establish persistence.

When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the /Library/LaunchDaemons/ folder with the RunAtLoad key set to true establishing persistence as a Launch Daemon.

Bundlore can persist via a LaunchDaemon.

If running with root permissions, OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchDaemons.

XCSSET uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.

AppleJeus has placed a plist file within the LaunchDaemons folder and launched it manually.

LoudMiner adds plist files with the naming format com.[random_name].plist in the /Library/LaunchDaemons folder with the RunAtLoad and KeepAlive keys set to true.

UPSTYLE creates a `.pth` file beginning with the text `import` so that any time another process or script attempts to reference the modified item the malicious code will also run.

XCSSET's `dfhsebxzod` module searches for `.xcodeproj` directories within the user’s home folder and subdirectories. For each match, it locates the corresponding `project.pbxproj` file and embeds an encoded payload into a build rule, target configuration, or project setting. The payload is later executed during the build process.

Pacu can set up S3 bucket notifications to trigger a malicious Lambda function when a CloudFormation template is uploaded to the bucket. It can also create Lambda functions that trigger upon the creation of users, roles, and groups.

Mini Shai-Hulud has modified settings and configuration files of AI coding agents and other coding applications in order to create event triggered executions through creating hooks and runOn conditions.

SILENTTRINITY can conduct an image hijack of an `.msc` file extension as part of its UAC bypass process.

Gazer can establish persistence through the system screensaver by configuring it to execute the malware.

Sardonic can use a WMI event filter to invoke a command-line event consumer to gain persistence.

adbupd can use a WMI script to achieve persistence.

BADHATCH can use WMI event subscriptions for persistence.

HOPLIGHT can use WMI event subscriptions to create persistence.

RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started.

POSHSPY uses a WMI event subscription to establish persistence.

SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.

TrailBlazer has the ability to use WMI for persistence.

metaMain registered a WMI event subscription consumer called "hard_disk_stat" to establish persistence.

Kevin can compile randomly-generated MOF files into the WMI repository to persistently run malware.

POWERTON can use WMI for persistence.

SILENTTRINITY can create a WMI Event to execute a payload for persistence.