T1569.002 Service Execution
Sub-technique of T1569 System Services
Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- CobaltStrike Service Installations - Systemcriticaltest · windows
- CosmicDuke Service Installationcriticaltest · windows
- DNS RCE CVE-2020-1350criticaltest · windows
- HackTool - SharpUp PrivEsc Tool Executioncriticaltest · windows
- CobaltStrike Service Installations - Securityhightest · windows
- Credential Dumping Tools Service Execution - Securityhightest · windows
- Credential Dumping Tools Service Execution - Systemhightest · windows
- HackTool Service Registration or Executionhightest · windows
- Metasploit Or Impacket Service Installation Via SMB PsExechightest · windows
- PSExec and WMI Process Creations Blockhightest · windows
- PUA - CsExec Executionhightest · windows
- PUA - NSudo Executionhightest · windows
- PUA - NirCmd Execution As LOCAL SYSTEMhightest · windows
- PUA - RunXCmd Executionhightest · windows
- Potential CVE-2022-26809 Exploitation Attempthightest · windows
- Potential CobaltStrike Service Installations - Registryhightest · windows
- PowerShell Scripts Installed as Serviceshightest · windows
- PowerShell Scripts Installed as Services - Securityhightest · windows
- PowerShell as a Service in Registryhightest · windows
- ProcessHacker Privilege Elevationhightest · windows
- Remote Server Service Abuse for Lateral Movementhightest · rpc_firewall
- Rundll32 Execution Without Parametershightest · windows
- Sliver C2 Default Service Installationhightest · windows
- smbexec.py Service Installationhightest · windows
- CSExec Service File Creationmediumtest · windows
Showing 25 of 39.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.