Applied Cybernetics Group
T1543.003 — Windows Service
- Technique
T1543.003- Tactics
- Persistence, Privilege Escalation
- MISP citations
- 1
- KEV CVEs mapped
- 0
- Community rules
- 47
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1543/003
MITRE description
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API. Adversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via [Native API](https://attack.mitre.org/techniques/T1106) functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)), or by using command-line utilities such as `PnPUtil.exe`.(Citation: Symantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Unit42 AcidBox June 2020) Adversaries may leverage these drivers as [Rootkit](https://attack.mitre.org/techniques/T1014)s to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020) Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002). To make detection analysis more challenging, malicious services may also incorporate [Masquerade Task or Service](https://attack.mitre.org/techniques/T1036/004) (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create ‘hidden’ services (i.e., [Hide Artifacts](https://attack.mitre.org/techniques/T1564)), for example by using the `sc sdset` command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as `Get-Service`, `sc query`, and `services.exe`.(Citation: SANS 1)(Citation: SANS 2)
Citing MISP events
Detection coverage
SigmaHQ community rules
- CosmicDuke Service Installation (emerging-threats)
- StoneDrill Service Install (emerging-threats)
- Turla Service Install (emerging-threats)
- Turla PNG Dropper Service (emerging-threats)
- OilRig APT Activity (emerging-threats)
- OilRig APT Registry Persistence (emerging-threats)
- OilRig APT Schedule Task Persistence - Security (emerging-threats)
- OilRig APT Schedule Task Persistence - System (emerging-threats)
- Moriya Rootkit File Created (emerging-threats)
- Special File Creation via Mknod Syscall (core)
- CobaltStrike Service Installations - Security (core)
- Remote Access Tool Services Have Been Installed - Security (core)
- CobaltStrike Service Installations - System (core)
- Moriya Rootkit - System (core)
- New PDQDeploy Service - Client Side (core)
- New PDQDeploy Service - Server Side (core)
- ProcessHacker Privilege Elevation (core)
- Remote Access Tool Services Have Been Installed - System (core)
- Sliver C2 Default Service Installation (core)
- Suspicious Service Installation (core)
- Uncommon Service Installation Image Path (core)
- Service Installation with Suspicious Folder Pattern (core)
- Service Installation in Suspicious Folder (core)
- Suspicious Service Installation Script (core)
- Malicious Driver Load By Name (core)
Showing 25 of 47 community rules —
the full set is tagged attack.t1543.003 in
SigmaHQ.