T1569.002 Service Execution
Subtécnica de T1569 System Services
Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- CobaltStrike Service Installations - Systemcriticaltest · windows
- CosmicDuke Service Installationcriticaltest · windows
- DNS RCE CVE-2020-1350criticaltest · windows
- HackTool - SharpUp PrivEsc Tool Executioncriticaltest · windows
- CobaltStrike Service Installations - Securityhightest · windows
- Credential Dumping Tools Service Execution - Securityhightest · windows
- Credential Dumping Tools Service Execution - Systemhightest · windows
- HackTool Service Registration or Executionhightest · windows
- Metasploit Or Impacket Service Installation Via SMB PsExechightest · windows
- PSExec and WMI Process Creations Blockhightest · windows
- PUA - CsExec Executionhightest · windows
- PUA - NSudo Executionhightest · windows
- PUA - NirCmd Execution As LOCAL SYSTEMhightest · windows
- PUA - RunXCmd Executionhightest · windows
- Potential CVE-2022-26809 Exploitation Attempthightest · windows
- Potential CobaltStrike Service Installations - Registryhightest · windows
- PowerShell Scripts Installed as Serviceshightest · windows
- PowerShell Scripts Installed as Services - Securityhightest · windows
- PowerShell as a Service in Registryhightest · windows
- ProcessHacker Privilege Elevationhightest · windows
- Remote Server Service Abuse for Lateral Movementhightest · rpc_firewall
- Rundll32 Execution Without Parametershightest · windows
- Sliver C2 Default Service Installationhightest · windows
- smbexec.py Service Installationhightest · windows
- CSExec Service File Creationmediumtest · windows
Mostrando 25 de 39.
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.