Cross-source coverage

T1569.002 / ATT&CK

System Services: Service Execution

76 rules across 7 sources.

From MITRE ATT&CK 19.2

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services. The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net.

PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API. Tools such as PsExec and sc.exe can accept remote servers as arguments and may be used to conduct remote execution.

Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation.

Tactics: Execution
Platforms: Windows
Telemetry: WinEventLog:SecurityWinEventLog:Sysmon

How MITRE says to detect it DET0421

Detection Strategy for System Services Service Execution

Windows Analytic 1185

Detection focuses on abnormal service executions initiated via service control manager APIs, sc.exe, net.exe, or PsExec creating temporary services. Defenders observe process creation of services.exe spawning non-standard binaries, registry changes in service keys followed by rapid execution, and network connections originating from processes tied to transient services. Correlation across process lineage, registry activity, and service logs provides strong signals of malicious service execution.

WinEventLog:Security EventCode=4697
WinEventLog:Sysmon EventCode=1
WinEventLog:Sysmon EventCode=13, 14
WinEventLog:Sysmon EventCode=3, 22

View on attack.mitre.org ↗

SigmaHQ/sigma

43 rules

Detection	Severity	Format
CobaltStrike Service Installations - System	Critical	Sigma
CosmicDuke Service Installation	Critical	Sigma
DNS RCE CVE-2020-1350	Critical	Sigma
HackTool - SharpUp PrivEsc Tool Execution	Critical	Sigma
CobaltStrike Service Installations - Security	High	Sigma
Credential Dumping Tools Service Execution - Security	High	Sigma
Credential Dumping Tools Service Execution - System	High	Sigma
HackTool Service Registration or Execution	High	Sigma
Metasploit Or Impacket Service Installation Via SMB PsExec	High	Sigma
Potential CobaltStrike Service Installations - Registry	High	Sigma

+ 33 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

14 rules

Detection	Severity	Format
Potential Privilege Escalation via Service ImagePath Modification	Medium	Elastic TOML
Remotely Started Services via RPC	Medium	Elastic TOML
Remote Windows Service Installed	Medium	Elastic TOML
Suspicious Process Execution via Renamed PsExec Executable	Medium	Elastic TOML
Suspicious Service was Installed in the System	Medium	Elastic TOML
System Shells via Services	Medium	Elastic TOML
Unsigned DLL Loaded by Svchost	Medium	Elastic TOML
PsExec Network Connection	Low	Elastic TOML
Service Command Lateral Movement	Low	Elastic TOML
Service Control Spawned via Script Interpreter	Low	Elastic TOML

+ 4 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

11 rules

Detection	Severity	Format
Detect Renamed PSExec	Undefined	SPL
Excessive Usage Of SC Service Utility	Undefined	SPL
First Time Seen Running Windows Service	Undefined	SPL
Linux Auditd Service Started	Undefined	SPL
Malicious Powershell Executed As A Service	Undefined	SPL
Windows ScManager Security Descriptor Tampering Via Sc.EXE	Undefined	SPL
Windows Service Created with Suspicious Service Name	Undefined	SPL
Windows Service Created with Suspicious Service Path	Undefined	SPL
Windows Service Create SliverC2	Undefined	SPL
Windows Service Execution RemCom	Undefined	SPL

+ 1 more from splunk/security_content → showing the 10 highest-severity

Wazuh Core Ruleset

5 rules

Detection	Severity	Format
MS-DHCP: Service has not determined if it is authorized in AD.	High	Wazuh XML
MS-DHCP: Service not authorized in AD.	High	Wazuh XML
New Windows Service Created to start from windows root path. Suspicious event as the binary may have been dropped using Windows Admin Shares.	High	Wazuh XML
osquery: : CCleaner Trojan Floxif detected on service for user · osquery.name = CCleaner_Trojan_stage2.Floxif	Low	Wazuh XML
PSEXEC was used to execute · win.eventdata.parentCommandLine = (?i)PSEXESVC\.exe	Low	Wazuh XML

Azure/Azure-Sentinel

1 rule

Detection	Severity	Format
detect-impacket-psexec-module	Undefined	KQL

elastic/protections-artifacts

1 rule

Detection	Severity	Format
Service Created by Suspicious Process and Activated	Undefined	Elastic TOML

socfortress/Wazuh-Rules

1 rule

Detection	Severity	Format
Use of Impacket's psexec.py tool (T1569.002)	High	Wazuh XML