System Services: Service Execution

Anchor can create and execute services to load its payload.^[3][4]

APT32's backdoor has used Windows services as a way to execute its malicious payload. ^[5]

APT38 has created new services or modified existing ones to run executables, commands, or scripts.^[6]

APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.^[7][8]

APT41 used svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.^[9][10]

Attor's dispatcher can be executed as a service.^[11]

Bad Rabbit drops a file named infpub.datinto the Windows directory and is executed through SCManager and rundll.exe.

BBSRAT can start, stop, or delete services.^[12]

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.^[13]

Brute Ratel C4 can create Windows system services for execution.^[14]

Chimera has used PsExec to deploy beacons on compromised systems.^[15]

Clambling can create and start services on a compromised host.^[16]

Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.^[17][18][19]

Empire can use PsExec to execute a payload on a remote host.^[20]

FIN6 has created Windows services to execute encoded PowerShell commands.^[21]

gh0st RAT can execute its service if the Service key exists. If the key does not exist, gh0st RAT will create and run the service.^[22]

HermeticWiper can create system services to aid in executing the payload.^[23][24][25]

HermeticWizard can use OpenRemoteServiceManager to create a service.^[26]

HOPLIGHT has used svchost.exe to execute a malicious DLL .^[27]

Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.^[28]

HyperBro has the ability to start and stop a specified service.^[29]

Impacket contains various modules emulating other service execution tools such as PsExec.^[30]

InvisiMole has used Windows services as a way to execute its malicious payload.^[31]

Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.^[32]

Koadic can run a command on another machine using PsExec.^[33]

LoudMiner started the cryptomining virtual machine as a service on the infected machine.^[34]

Mafalda can create a remote service, let it run once, and then delete it.^[35]

The net start and net stop commands can be used in Net to execute or stop Windows services.^[36]

Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.^[37]

Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.^[38]

NotPetya can use PsExec to help propagate itself across a network.^[39][40]

Okrum's loader can create a new service named NtmsSvc to execute the payload.^[41]

Olympic Destroyer utilizes PsExec to help propagate itself across a network.^[42]

During Operation Honeybee, threat actors ran sc start to start the COMSysApp as part of the service hijacking and sc stop to stop and reconfigure the COMSysApp.^[43]

During Operation Wocao, threat actors created services on remote systems for execution purposes.^[44]

Pandora has the ability to install itself as a Windows service.^[45]

PoshC2 contains an implementation of PsExec for remote execution.^[46]

Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.^[47]

Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.^[2]

Pupy uses PsExec to execute a payload or commands on a remote host.^[48]

Pysa has used PsExec to copy and execute the ransomware.^[49]

Ragnar Locker has used sc.exe to execute a service that it creates.^[50]

RemoteCMD can execute commands remotely by creating a new service on the remote system.^[51]

Shamoon creates a new service named "ntssrv" to execute the payload. Shamoon can also spread via PsExec.^[52][53]

Silence has used Winexe to install a service on the remote system.^[54][55]

SLOTHFULMEDIA has the capability to start services.^[56]

StrongPity can install a service to execute itself as a service.^[57][58]

SysUpdate can manage services and processes.^[45]

TinyTurla can install itself as a service on compromised machines.^[59]

WastedLocker can execute itself as a service.^[60]

WhisperGate can download and execute AdvancedRun.exe via sc.exe.^[61][62]

Winexe installs a service on the remote system, executes the command, then uninstalls the service.^[63]

Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.^[64][65]

Winnti for Windows can run as a service using svchost.exe.^[66]

Wizard Spider has used services.exe to execute scripts and executables during lateral movement within a victim's network. Wizard Spider has also used batch scripts that leverage PsExec to execute a previously transferred ransomware payload on a victim's network.^[67][68][69]

xCmd can be used to execute binaries on remote systems by creating and starting a service.^[70]

ZxShell can create a new service for execution.^[71]

On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by PsExec from running. ^[72]

Ensure that permissions disallow services that run at a higher permissions level from being created or interacted with by a user with a lower permission level.

Ensure that high permission level service binaries cannot be replaced or modified by users with a lower permission level.