Procedure examples

Lotus Blossom has configured tools such as Sagerunex to run as Windows services.

Cinnamon Tempest has created system services to establish persistence for deployed tooling.

Medusa Group has used vulnerable or signed drivers to modify security solutions on victim devices.

Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence.

Several Lazarus Group malware families install themselves as new services.

Earth Lusca created a service using the command sc create “SysUpdate” binpath= “cmd /c start “[file path]””&&sc config “SysUpdate” start= auto&&net
start SysUpdate for persistence.

Cobalt Group has created new services to establish persistence.

Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.

PROMETHIUM has created new services and modified existing services for persistence.

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.

An APT19 Port 22 malware variant registers itself as a service.

TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.

Ninja can create the services `httpsvc` and `w3esvc` for persistence .

Wiarp creates a backdoor through which remote attackers can create a service.

The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV.”

Stuxnet uses a driver registered as a boot start service as the main load-point.

If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.

Emissary is capable of configuring itself as a service.

Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.

ThreatNeedle can run in memory and register its payload as a Windows service.

ZLib creates Registry keys to allow itself to run as various services.

Bankshot can terminate a specific process by its process id.

StrongPity has created new services and modified existing services for persistence.

Nebulae can create a service to establish persistence.

AuditCred is installed as a new service on the system.

TONESHELL has created a malicious service DISMsrv to maintain persistence.

Hannotog creates a new service for persistence.

Medusa Ransomware has created a new PowerShell process using the `CreateProcessA` API.

RainyDay can use services to establish persistence.

BOOKWORM has created a service named `Microsoft Windows DeviceSync Service` at `HKLM\SYSTEM\CurrentControlSet\Services\DeviceSync\` to trigger execution when the system starts and to maintain persistence.

CosmicDuke uses Windows services typically named "javamtsup" for persistence.

GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.

Emotet has been observed creating new services to maintain persistence.

TEARDROP ran as a Windows service from the c:\windows\syswow64 folder.

DUSTPAN can persist as a Windows Service in operations.

PingPull has the ability to install itself as a service.

SUGARUSH has created a service named `Service1` for persistence.

WastedLocker created and established a service that runs until the encryption process is complete.

InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.

Naid creates a new service to establish.

Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.

ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.

RDAT has created a service when it is installed on the victim machine.

To establish persistence, Okrum can install itself as a new service named NtmSsvc.

Kazuar can install itself as a new service.

Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.

One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.

zwShell has established persistence by adding itself as a new service.

DCSrv has created new services for persistence by modifying the Registry.

ShimRat has installed a Windows service to maintain persistence on victim machines.