T1569 System Services
Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- CVE-2021-1675 Print Spooler Exploitationcriticaltest · windows
- CVE-2021-1675 Print Spooler Exploitation IPC Accesscriticaltest · windows
- CobaltStrike Service Installations - Systemcriticaltest · windows
- CosmicDuke Service Installationcriticaltest · windows
- DNS RCE CVE-2020-1350criticaltest · windows
- HackTool - SharpUp PrivEsc Tool Executioncriticaltest · windows
- CobaltStrike Service Installations - Securityhightest · windows
- Credential Dumping Tools Service Execution - Securityhightest · windows
- Credential Dumping Tools Service Execution - Systemhightest · windows
- HackTool Service Registration or Executionhightest · windows
- Metasploit Or Impacket Service Installation Via SMB PsExechightest · windows
- PSExec and WMI Process Creations Blockhightest · windows
- PUA - CsExec Executionhightest · windows
- PUA - NSudo Executionhightest · windows
- PUA - NirCmd Execution As LOCAL SYSTEMhightest · windows
- PUA - RunXCmd Executionhightest · windows
- Possible CVE-2021-1675 Print Spooler Exploitationhightest · windows
- Potential CVE-2022-26809 Exploitation Attempthightest · windows
- Potential CobaltStrike Service Installations - Registryhightest · windows
- PowerShell Scripts Installed as Serviceshightest · windows
- PowerShell Scripts Installed as Services - Securityhightest · windows
- PowerShell as a Service in Registryhightest · windows
- ProcessHacker Privilege Elevationhightest · windows
- Remote Server Service Abuse for Lateral Movementhightest · rpc_firewall
- Rundll32 Execution Without Parametershightest · windows
Showing 25 of 44.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.