Procedure examples

Anchor can create and execute services to load its payload.

BBSRAT can start, stop, or delete services.

Clambling can create and start services on a compromised host.

DarkGate tries to elevate privileges to SYSTEM using PsExec to locally execute as a service, such as cmd /c c:\temp\PsExec.exe -accepteula -j -d -s [Target Binary].

LockBit 3.0 can use PsExec to execute commands and payloads.

Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.

Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.

Embargo has created a service named irnagentd that executed the MDeployer loader after the system is rebooted in Safe Mode.

gh0st RAT can execute its service if the Service key exists. If the key does not exist, gh0st RAT will create and run the service.

Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec.

Attor's dispatcher can be executed as a service.

HermeticWiper can create system services to aid in executing the payload.

Pysa has used PsExec to copy and execute the ransomware.

Pandora has the ability to install itself as a Windows service.

Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.

Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.

IPsec Helper is run as a Windows service in victim environments.

SysUpdate can manage services and processes.

ZxShell can create a new service for execution.

Winnti for Windows can run as a service using svchost.exe.

DEADWOOD can be executed as a service using various names, such as ScDeviceEnums.

LoudMiner started the cryptomining virtual machine as a service on the infected machine.

Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.

SLOTHFULMEDIA has the capability to start services.

HermeticWizard can use `OpenRemoteServiceManager` to create a service.

The net start and net stop commands can be used in Net to execute or stop Windows services.

Impacket contains various modules emulating other service execution tools such as PsExec.

Empire can use PsExec to execute a payload on a remote host.

PoshC2 contains an implementation of PsExec for remote execution.

xCmd can be used to execute binaries on remote systems by creating and starting a service.

Brute Ratel C4 can create Windows system services for execution.

Winexe installs a service on the remote system, executes the command, then uninstalls the service.

Koadic can run a command on another machine using PsExec.

Pupy uses PsExec to execute a payload or commands on a remote host.

Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.

CanisterWorm has used executed `systemctl --user daemon-reload` to reload systemd, then enables and starts the malicious service.

Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.

Havoc has the ability to copy files from one location to another.

Emotet has copied itself to remote systems using the `service.exe` filename.

Olympic Destroyer attempts to copy itself to remote machines on the network.

SameCoin can copy its wiper executable to remote machines within the same Active Directory.

BlackCat can replicate itself across connected servers via `psexec`.

Lucifer can use certutil for propagation on Windows hosts within intranets.

LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.

DustySky searches for network drives and removable media and duplicates itself onto them.

Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.

WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.

VIRTUALPIE has file transfer capabilities.

Shamoon attempts to copy itself to remote machines on the network.

BlackByte Ransomware spreads itself laterally by writing the JavaScript launcher file to mapped shared folders.