Procedure examples

APT38 has created new services or modified existing ones to run executables, commands, or scripts.

BlackByte created malicious services for ransomware execution.

APT41 used svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.

APT32's backdoor has used Windows services as a way to execute its malicious payload.

FIN6 has created Windows services to execute encoded PowerShell commands.

FIN7 has started the SSH service by executing `sc start sshd`.

APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.

Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.

Chimera has used PsExec to deploy beacons on compromised systems.

Medusa Group has utilized PsExec to execute scripts and commands within victim environments. Medusa Group has also used the Windows service RoboCopy to search and copy data for exfiltration.

INC Ransom has run a file encryption executable via `Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem`.

Silence has used Winexe to install a service on the remote system.

Wizard Spider has used `services.exe` to execute scripts and executables during lateral movement within a victim's network. Wizard Spider has also used batch scripts that leverage PsExec to execute a previously transferred ransomware payload on a victim's network.

Velvet Ant executed and installed PlugX as a Windows service.

Moonstone Sleet used intermediate loader malware such as YouieLoader and SplitLoader that create malicious services.