T1543.003sub-technique of T1543 Create or Modify System Process
Windows Service
Windows4 pieces on this siteT1543.003 on attack.mitre.org
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
If this is happening now
Checklists and playbooks to open while the alert is still live.
How to find what an operator left behind
You have evicted somebody, or believe you have, and need to be sure there is no way back in.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma endpoint pack: seven rules for the Windows techniques that keep working
Shadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: a service that starts before you do
Windows services run as SYSTEM and start before anyone logs in, which makes them the most valuable persistence on the box and the hardest to spot among the two hundred already there. Part three of the persistence series.
Read
Analyses, case studies, guides, references and interview questions.
Windows event log cheat sheet: by the question you are asking
Organised by what you are trying to establish rather than by number: who logged on and how, what ran, what persisted, what was tampered with. Every entry says which log, whether it is on by default, and what it does not tell you.
how MITRE says to see it
Detection of Windows Service Creation or Modification
- Detects creation or modification of Windows Services through command-line tools (e.g., `sc.exe`, `powershell.exe`), Registry key changes under `HKLM\System\CurrentControlSet\Services`, and service execution under SYSTEM with unsigned or anomalous binary paths.
what reduces it
- M1028 Operating System Configuration. Ensure that Driver Signature Enforcement is enabled to restrict unsigned drivers from being installed.
- M1045 Code Signing. Enforce registration and execution of only legitimately signed service drivers where possible.
- M1040 Behavior Prevention on Endpoint. On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent an application from writing a signed vulnerable driver to the system. On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed service drivers.
- M1018 User Account Management. Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.
- M1047 Audit. Use auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them.