Procedure examples

APT38 has installed a new Windows service to establish persistence.

BlackByte modified multiple services on victim machines to enable encryption operations. BlackByte has installed tools such as AnyDesk as a service on victim machines.

APT3 has a tool that creates a new service for persistence.

Kimsuky has created new services for persistence.

APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.

APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.

TeamTNT has used malware that adds cryptocurrency miners as a service.

FIN7 created new Windows services and added them to the startup directories for persistence.

OilRig has used a compromised Domain Controller to create a service on a remote host.

Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.

Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.

Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.

Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.

Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.

DarkVishnya created new services for shellcode loaders distribution.

Lotus Blossom has configured tools such as Sagerunex to run as Windows services.

Cinnamon Tempest has created system services to establish persistence for deployed tooling.

Medusa Group has used vulnerable or signed drivers to modify security solutions on victim devices.

Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence.

Several Lazarus Group malware families install themselves as new services.

Earth Lusca created a service using the command sc create “SysUpdate” binpath= “cmd /c start “[file path]””&&sc config “SysUpdate” start= auto&&net
start SysUpdate for persistence.

Cobalt Group has created new services to establish persistence.

Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.

PROMETHIUM has created new services and modified existing services for persistence.

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.

An APT19 Port 22 malware variant registers itself as a service.