T1569.002sub-technique of T1569 System Services
Service Execution
Windows2 pieces on this siteT1569.002 on attack.mitre.org
Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (`services.exe`) is an interface to manage and manipulate services. The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: a service that existed for nine seconds
Remote execution over the admin share, reconstructed from the target. Tie four events in three logs into one action, work back to the host it came from, and handle the version where the service is not called PSEXESVC.
Seventeen hours at Calderbrook: from a password spray to data leaving
A constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.
how MITRE says to see it
Detection Strategy for System Services Service Execution
- Detection focuses on abnormal service executions initiated via service control manager APIs, sc.exe, net.exe, or PsExec creating temporary services. Defenders observe process creation of services.exe spawning non-standard binaries, registry changes in service keys followed by rapid execution, and network connections...
what reduces it
- M1040 Behavior Prevention on Endpoint. On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by PsExec from running.
- M1022 Restrict File and Directory Permissions. Ensure that high permission level service binaries cannot be replaced or modified by users with a lower permission level.
- M1026 Privileged Account Management. Ensure that permissions disallow services that run at a higher permissions level from being created or interacted with by a user with a lower permission level.