Cross-source coverage

T1569 / ATT&CK

System Services

92 rules · 91 families across 7 sources.

From MITRE ATT&CK 19.2

Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence (Create or Modify System Process), but adversaries can also abuse services for one-time or temporary execution.

Tactics: Execution
Platforms: Windows · macOS · Linux
Telemetry: WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:syslogmacos:unifiedlog

How MITRE says to detect it DET0279

Detection Strategy for System Services across OS platforms.

Windows Analytic 0778

Monitor for abnormal creation or modification of Windows services (e.g., via sc.exe, PowerShell, or API calls) that load non-standard executables. Correlate registry changes in service keys with service creation events and process execution to detect service abuse for persistence or execution.

WinEventLog:Security EventCode=4697
WinEventLog:Sysmon EventCode=1
WinEventLog:Sysmon EventCode=13, 14

Linux Analytic 0779

Detect unusual invocations of systemctl, service, or init scripts creating or modifying daemons. Monitor audit logs for execution of binaries from unexpected paths linked to service start/stop activity.

auditd:SYSCALL execve
linux:syslog systemctl start/enable with uncommon binary paths
auditd:SYSCALL write

macOS Analytic 0780

Monitor launchd service definitions and property list (.plist) modifications for non-standard executables. Detect unauthorized processes registered as launch daemons or agents.

macos:unifiedlog Unexpected processes registered with launchd
macos:unifiedlog Modification of LaunchAgents or LaunchDaemons plist files

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 92 above — a rule tagged a sub-technique covers this technique too.

SigmaHQ/sigma

48 rules

Detection	Severity	Format
CobaltStrike Service Installations - System	Critical	Sigma
CosmicDuke Service Installation	Critical	Sigma
CVE-2021-1675 Print Spooler Exploitation	Critical	Sigma
CVE-2021-1675 Print Spooler Exploitation IPC Access	Critical	Sigma
DNS RCE CVE-2020-1350	Critical	Sigma
HackTool - SharpUp PrivEsc Tool Execution	Critical	Sigma
CobaltStrike Service Installations - Security	High	Sigma
Credential Dumping Tools Service Execution - Security	High	Sigma
Credential Dumping Tools Service Execution - System	High	Sigma
HackTool Service Registration or Execution	High	Sigma

+ 38 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

15 rules

Detection	Severity	Format
Potential Privilege Escalation via Service ImagePath Modification	Medium	Elastic TOML
Remotely Started Services via RPC	Medium	Elastic TOML
Remote Windows Service Installed	Medium	Elastic TOML
Suspicious Process Execution via Renamed PsExec Executable	Medium	Elastic TOML
Suspicious Service was Installed in the System	Medium	Elastic TOML
System Shells via Services	Medium	Elastic TOML
Unsigned DLL Loaded by Svchost	Medium	Elastic TOML
Launch Service Creation and Immediate Loading	Low	Elastic TOML
PsExec Network Connection	Low	Elastic TOML
Service Command Lateral Movement	Low	Elastic TOML

+ 5 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

11 rules

Detection	Severity	Format
Detect Renamed PSExec	Undefined	SPL
Excessive Usage Of SC Service Utility	Undefined	SPL
First Time Seen Running Windows Service	Undefined	SPL
Linux Auditd Service Started	Undefined	SPL
Malicious Powershell Executed As A Service	Undefined	SPL
Windows ScManager Security Descriptor Tampering Via Sc.EXE	Undefined	SPL
Windows Service Created with Suspicious Service Name	Undefined	SPL
Windows Service Created with Suspicious Service Path	Undefined	SPL
Windows Service Create SliverC2	Undefined	SPL
Windows Service Execution RemCom	Undefined	SPL

+ 1 more from splunk/security_content → showing the 10 highest-severity

socfortress/Wazuh-Rules

7 rules · 6 families

Detection	Severity	Format
Sysmon - Event 1: Process creation · Service Execution (T1569.002) 2 variants	High	Wazuh XML
Use of Impacket's psexec.py tool (T1569.002)	High	Wazuh XML
Sysmon - Event 12: RegistryEvent (Object create and delete) by · Service Execution (T1569.002)	Low	Wazuh XML
Sysmon - Event 13: RegistryEvent (Value Set) by · Service Execution (T1569.002)	Low	Wazuh XML
Sysmon - Event 14: RegistryEvent (Key and Value Rename) by · Service Execution (T1569.002)	Low	Wazuh XML
Sysmon - Event 1: Process creation · Service Execution (T1569.002) 2 variants	Low	Wazuh XML
Sysmon - Event 3: Network connection by · Service Execution (T1569.002)	Low	Wazuh XML

Wazuh Core Ruleset

5 rules

Detection	Severity	Format
MS-DHCP: Service has not determined if it is authorized in AD.	High	Wazuh XML
MS-DHCP: Service not authorized in AD.	High	Wazuh XML
New Windows Service Created to start from windows root path. Suspicious event as the binary may have been dropped using Windows Admin Shares.	High	Wazuh XML
osquery: : CCleaner Trojan Floxif detected on service for user · osquery.name = CCleaner_Trojan_stage2.Floxif	Low	Wazuh XML
PSEXEC was used to execute · win.eventdata.parentCommandLine = (?i)PSEXESVC\.exe	Low	Wazuh XML

Azure/Azure-Sentinel

3 rules

Detection	Severity	Format
Dev-0228 File Path Hashes November 2021	High	KQL
Dev-0228 File Path Hashes November 2021 (ASIM Version)	High	KQL
detect-impacket-psexec-module	Undefined	KQL

elastic/protections-artifacts

3 rules

Detection	Severity	Format
Initial Access via macOS Installer Package	Undefined	Elastic TOML
Launchctl Submit Execution of Downloaded File	Undefined	Elastic TOML
Service Created by Suspicious Process and Activated	Undefined	Elastic TOML