Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (
services.exe) is an interface to manage and manipulate services. The service control manager is accessible to users via GUI components as well as system utilities such as
sc.exe and Net.
PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API. Tools such as PsExec and
sc.exe can accept remote servers as arguments and may be used to conduct remote execution.
Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation.
Bad Rabbit drops a file named
|M1040||Behavior Prevention on Endpoint|
|M1026||Privileged Account Management||
Ensure that permissions disallow services that run at a higher permissions level from being created or interacted with by a user with a lower permission level.
|M1022||Restrict File and Directory Permissions||
Ensure that high permission level service binaries cannot be replaced or modified by users with a lower permission level.
|ID||Data Source||Data Component|
|DS0024||Windows Registry||Windows Registry Key Modification|
Changes to service Registry entries and command line invocation of tools capable of modifying services that do not correlate with known software, patch cycles, etc., may be suspicious. If a service is used only to execute a binary or script and not to persist, then it will likely be changed back to its original form shortly after the service is restarted so the service is not left broken, as is the case with the common administrator tool PsExec.