System Services: Service Execution

APT32's backdoor has used Windows services as a way to execute its malicious payload. ^[34]

APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.^[39][40]

APT41 used Net to execute a system service installed to launch a Cobalt Strike BEACON loader.^[38]

Attor's dispatcher can be executed as a service.^[27]

BBSRAT can start, stop, or delete services.^[21]

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.^[41]

Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.^[7][8]

Empire can use PsExec to execute a payload on a remote host.^[11]

FIN6 has created Windows services to execute encoded PowerShell commands.^[35]

Honeybee launches a DLL file that gets executed as a service using svchost.exe^[32]

HOPLIGHT has used svchost.exe to execute a malicious DLL .^[25]

Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.^[15]

HyperBro has the ability to start and stop a specified service.^[26]

Impacket contains various modules emulating other service execution tools such as PsExec.^[10]

Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.^[33]

Koadic can run a command on another machine using PsExec.^[4]

LoudMiner started the cryptomining virtual machine as a service on the infected machine.^[29]

The net start and net stop commands can be used in Net to execute or stop Windows services.^[3]

Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.^[18]

Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.^[30]

NotPetya can use PsExec to help propagate itself across a network.^[23][24]

Okrum's loader can create a new service named NtmsSvc to execute the payload.^[28]

Olympic Destroyer utilizes PsExec to help propagate itself across a network.^[22]

PoshC2 contains an implementation of PsExec for remote execution.^[12]

Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.^[14]

Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.^[2]

Pupy uses PsExec to execute a payload or commands on a remote host.^[5]

Ragnar Locker has used sc.exe to execute a service that it creates.^[31]

RemoteCMD can execute commands remotely by creating a new service on the remote system.^[13]

Shamoon creates a new service named "ntssrv" to execute the payload. Shamoon can also spread via PsExec.^[19][20]

Silence has used Winexe to install a service on the remote system.^[36][37]

Winexe installs a service on the remote system, executes the command, then uninstalls the service.^[9]

Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.^[16][17]

xCmd can be used to execute binaries on remote systems by creating and starting a service.^[6]

Ensure that permissions disallow services that run at a higher permissions level from being created or interacted with by a user with a lower permission level.

Ensure that high permission level service binaries cannot be replaced or modified by users with a lower permission level.