Windows Service

T1543.003

Sub-technique of T1543 Create or Modify System Process.View on attack.mitre.org

About this technique

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API.

Adversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via Native API functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. Modify Registry), or by using command-line utilities such as `PnPUtil.exe`. Adversaries may leverage these drivers as Rootkits to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of Exploitation for Privilege Escalation.

Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through Service Execution.

To make detection analysis more challenging, malicious services may also incorporate Masquerade Task or Service (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create ‘hidden’ services (i.e., Hide Artifacts), for example by using the `sc sdset` command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as `Get-Service`, `sc query`, and `services.exe`.

Detection rules63

Rules on DetectionCode tagged with T1543.003.

Sigma38

Rule	Level	Log source
CobaltStrike Service Installations - System	critical	windows / NULL
Moriya Rootkit - System	critical	windows / NULL
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE	high	windows / process_creation
CobaltStrike Service Installations - Security	high	windows / NULL
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE	high	windows / process_creation
Devcon Execution Disabling VMware VMCI Device	high	windows / process_creation
Driver Load From A Temporary Directory	high	windows / driver_load
Malicious Driver Load	high	windows / driver_load
Potential CobaltStrike Service Installations - Registry	high	windows / registry_set
ProcessHacker Privilege Elevation	high	windows / NULL
PSEXEC Remote Execution File Artefact	high	windows / file_event
PUA - Kernel Driver Utility (KDU) Execution	high	windows / process_creation
Service Installation with Suspicious Folder Pattern	high	windows / NULL
Sliver C2 Default Service Installation	high	windows / NULL
Suspicious New Service Creation	high	windows / process_creation
Suspicious Service DACL Modification Via Set-Service Cmdlet	high	windows / process_creation
Suspicious Service Installation	high	windows / NULL
Suspicious Service Installation Script	high	windows / NULL
Suspicious Service Path Modification	high	windows / process_creation
Vulnerable Driver Load	high	windows / driver_load
Vulnerable HackSys Extreme Vulnerable Driver Load	high	windows / driver_load
Vulnerable WinRing0 Driver Load	high	windows / driver_load
Malicious Driver Load By Name	medium	windows / driver_load
New Kernel Driver Via SC.EXE	medium	windows / process_creation
New PDQDeploy Service - Client Side	medium	windows / NULL
New PDQDeploy Service - Server Side	medium	windows / NULL
Potential Persistence Attempt Via Existing Service Tampering	medium	windows / process_creation
Remote Access Tool Services Have Been Installed - Security	medium	windows / NULL
Remote Access Tool Services Have Been Installed - System	medium	windows / NULL
Service Installation in Suspicious Folder	medium	windows / NULL
ServiceDll Hijack	medium	windows / registry_set
Sysinternals PsService Execution	medium	windows / process_creation
Sysinternals PsSuspend Execution	medium	windows / process_creation
Uncommon Service Installation Image Path	medium	windows / NULL
New Service Creation Using PowerShell	low	windows / process_creation
New Service Creation Using Sc.EXE	low	windows / process_creation
Special File Creation via Mknod Syscall	low	linux / NULL
Vulnerable Driver Load By Name	low	windows / driver_load

Splunk25

Rule	Type	Risk	Data source
CMD Echo Pipe - Escalation	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Impacket Lateral Movement Commandline Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Impacket Lateral Movement smbexec CommandLine Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Impacket Lateral Movement WMIExec Commandline Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Possible Lateral Movement PowerShell Spawn	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Randomly Generated Windows Service Name	Hunting	NULL	Windows Event Log System 7045
Sc exe Manipulating Windows Services	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Services LOLBAS Execution Process Spawn	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious Driver Loaded Path	TTP	NULL	Sysmon EventID 6
Windows Admin Password Changed by Non-Admin	TTP	NULL	Windows Event Log Security 4723
Windows Bluetooth Service Installed From Uncommon Location	Anomaly	NULL	Windows Event Log System 7045
Windows Cloud Files Filter Loaded by Uncommon Process	Anomaly	NULL	Sysmon EventID 7
Windows KrbRelayUp Service Creation	TTP	NULL	Windows Event Log System 7045
Windows MsMpEng Writing to System32	TTP	NULL	Sysmon EventID 15, Sysmon EventID 11
Windows Remote Create Service	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Service Create Kernel Mode Driver	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Service Create RemComSvc	Anomaly	NULL	Windows Event Log System 7045
Windows Service Create with Tscon	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Service Created Within Public Path	TTP	NULL	Windows Event Log System 7045
Windows Service Creation on Remote Endpoint	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Service Initiation on Remote Endpoint	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Suspicious Driver Loaded Path	TTP	NULL	Sysmon EventID 6
Windows Vulnerable Driver Installed	TTP	NULL	Windows Event Log System 7045
Windows Vulnerable Driver Loaded	Hunting	NULL	Sysmon EventID 6
XMRIG Driver Loaded	TTP	NULL	Sysmon EventID 6

Software109

Anchor AppleJeus Attor AuditCred Bankshot BBSRAT Bisonal BitPaymer Black Basta BlackEnergy BOOKWORM Briba Carbon Catchamas Clambling Cobalt Strike Conficker CorKLOG CosmicDuke CozyCar Cuba DCSrv Dtrack Duqu

Show 85 more

Campaigns5

2016 Ukraine Electric Power Attack APT41 DUST Operation CuckooBees Operation Digital Eye Operation Honeybee

Procedure examples140

Groups26

Used by	Procedure example
GroupAgrius	Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence. SentinelOne Agrius 2021
GroupAPT19	An APT19 Port 22 malware variant registers itself as a service. Unit 42 C0d0so0 Jan 2016
GroupAPT3	APT3 has a tool that creates a new service for persistence. FireEye Operation Double Tap
GroupAPT32	APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence. Cybereason Cobalt Kitty 2017 ESET OceanLotus ESET OceanLotus Mar 2019
GroupAPT38	APT38 has installed a new Windows service to establish persistence. CISA AA20-239A BeagleBoyz August 2020
GroupAPT41	APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike. FireEye APT41 Aug 2019 FireEye APT41 March 2020 Group IB APT 41 June 2021
GroupAquatic Panda	Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change. Crowdstrike HuntReport 2022
GroupBlackByte	BlackByte modified multiple services on victim machines to enable encryption operations. BlackByte has installed tools such as AnyDesk as a service on victim machines. Microsoft BlackByte 2023 Symantec BlackByte 2022

View all 26 groups examples

Software109

Used by	Procedure example
MalwareAnchor	Anchor can establish persistence by creating a service. Cyberreason Anchor December 2019
MalwareAppleJeus	AppleJeus can install itself as a service. CISA AppleJeus Feb 2021
MalwareAttor	Attor's dispatcher can establish persistence by registering a new service. ESET Attor Oct 2019
MalwareAuditCred	AuditCred is installed as a new service on the system. TrendMicro Lazarus Nov 2018
MalwareBankshot	Bankshot can terminate a specific process by its process id. McAfee Bankshot US-CERT Bankshot Dec 2017
MalwareBBSRAT	BBSRAT can modify service configurations. Palo Alto Networks BBSRAT
MalwareBisonal	Bisonal has been modified to be used as a Windows service. Talos Bisonal Mar 2020
MalwareBitPaymer	BitPaymer has attempted to install itself as a service to maintain persistence. Crowdstrike Indrik November 2018

View all 109 software examples

Campaigns5

Used by	Procedure example
Campaign2016 Ukraine Electric Power Attack	During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary. Dragos Crashoverride 2017
CampaignAPT41 DUST	APT41 DUST used Windows Services with names such as `Windows Defend` for persistence of DUSTPAN. Google Cloud APT41 2024
CampaignOperation CuckooBees	During Operation CuckooBees, the threat actors modified the `IKEEXT` and `PrintNotify` Windows services for persistence. Cybereason OperationCuckooBees May 2022
CampaignOperation Digital Eye	During Operation Digital Eye, threat actors created a service named Visual Studio Code Service to run Visual Studio code. sentinelone operationDigitalEye Dec 2024
CampaignOperation Honeybee	During Operation Honeybee, threat actors installed DLLs and backdoors as Windows services. McAfee Honeybee

References7

Crowdstrike DriveSlayer February 2022 Open source
Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022.
ESET InvisiMole June 2020 Open source
Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
SANS 1 Open source
Joshua Wright. (2020, October 13). Retrieved March 22, 2024.
SANS 2 Open source
Joshua Wright. (2020, October 14). Retrieved March 22, 2024.
Symantec W.32 Stuxnet Dossier Open source
Nicolas Falliere, Liam O. Murchu, Eric Chien. (2011, February). W32.Stuxnet Dossier. Retrieved December 7, 2020.
TechNet Services Open source
Microsoft. (n.d.). Services. Retrieved June 7, 2016.
Unit42 AcidBox June 2020 Open source
Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations. Retrieved March 16, 2021.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.