Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Create or Modify System Process: Служба Windows

Other sub-techniques of Create or Modify System Process (5)

ID	Название
.001	Агент запуска
.002	Служба systemd
.003	Служба Windows
.004	Демон запуска
.005	Container Service

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API. Adversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via Native API functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. Modify Registry), or by using command-line utilities such as `PnPUtil.exe`.(Citation: Symantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Unit42 AcidBox June 2020) Adversaries may leverage these drivers as Rootkits to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of Exploitation for Privilege Escalation.(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020) Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through Service Execution. To make detection analysis more challenging, malicious services may also incorporate Masquerade Task or Service (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create ‘hidden’ services (i.e., Hide Artifacts), for example by using the `sc sdset` command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as `Get-Service`, `sc query`, and `services.exe`.(Citation: SANS 1)(Citation: SANS 2)

ID: T1543.003

Относится к технике: T1543

Тактика(-и): Persistence, Privilege Escalation

Платформы: Windows

Источники данных: Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification

Версия: 1.5

Дата создания: 17 Jan 2020

Последнее изменение: 11 Apr 2024

Название	Описание
Примеры процедур
NightClub	NightClub has created a Windows service named `WmdmPmSp` to establish persistence.(Citation: MoustachedBouncer ESET August 2023)
Honeybee	Honeybee has batch files that modify the system service COMSysApp to load a malicious DLL.(Citation: McAfee Honeybee)
Industroyer	Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.(Citation: Dragos Crashoverride 2017)
Tropic Trooper	Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.(Citation: PWC KeyBoys Feb 2017)
FunnyDream	FunnyDream has established persistence by running `sc.exe` and by setting the `WSearch` service to run automatically.(Citation: Bitdefender FunnyDream Campaign November 2020)
Winnti for Windows	Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.(Citation: Microsoft Winnti Jan 2017)
Cuba	Cuba can modify services by using the `OpenService` and `ChangeServiceConfig` functions.(Citation: McAfee Cuba April 2021)
Briba	Briba installs a service pointing to a malicious DLL dropped to disk.(Citation: Symantec Briba May 2012)
DCSrv	DCSrv has created new services for persistence by modifying the Registry.(Citation: Checkpoint MosesStaff Nov 2021)
WastedLocker	WastedLocker created and established a service that runs until the encryption process is complete.(Citation: NCC Group WastedLocker June 2020)
GoldenSpy	GoldenSpy has established persistence by running in the background as an autostart service.(Citation: Trustwave GoldenSpy June 2020)
	During Operation CuckooBees, the threat actors modified the `IKEEXT` and `PrintNotify` Windows services for persistence.(Citation: Cybereason OperationCuckooBees May 2022)
DarkVishnya	DarkVishnya created new services for shellcode loaders distribution.(Citation: Securelist DarkVishnya Dec 2018)
Volgmer	Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.(Citation: US-CERT Volgmer Nov 2017)(Citation: US-CERT Volgmer 2 Nov 2017)(Citation: Symantec Volgmer Aug 2014)
MoonWind	MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.(Citation: Palo Alto MoonWind March 2017)
CosmicDuke	CosmicDuke uses Windows services typically named "javamtsup" for persistence.(Citation: F-Secure Cosmicduke)
PoisonIvy	PoisonIvy creates a Registry subkey that registers a new service. PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.(Citation: Symantec Darkmoon Aug 2005)
STARWHALE	STARWHALE has the ability to create the following Windows service to establish persistence on an infected host: `sc create Windowscarpstss binpath= "cmd.exe /c cscript.exe c:\\windows\\system32\\w7_1.wsf humpback_whale" start= "auto" obj= "LocalSystem"`.(Citation: Mandiant UNC3313 Feb 2022)
ZeroT	ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.(Citation: Proofpoint ZeroT Feb 2017)
Gelsemium	Gelsemium can drop itself in `C:\Windows\System32\spool\prtprocs\x64\winprint.dll` as an alternative Print Processor to be loaded automatically when the spoolsv Windows service starts.(Citation: ESET Gelsemium June 2021)
Aquatic Panda	Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.(Citation: Crowdstrike HuntReport 2022)
APT38	APT38 has installed a new Windows service to establish persistence.(Citation: CISA AA20-239A BeagleBoyz August 2020)
QakBot	QakBot can remotely create a temporary service on a target host.(Citation: NCC Group Black Basta June 2022)
Conficker	Conficker copies itself into the `%systemroot%\system32` directory and registers as a service.(Citation: SANS Conficker)
GreyEnergy	GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.(Citation: ESET GreyEnergy Oct 2018)
APT41	APT41 modified legitimate Windows services to install malware backdoors.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021) APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.(Citation: FireEye APT41 March 2020)
KeyBoy	KeyBoy installs a service pointing to a malicious DLL dropped to disk.(Citation: Rapid7 KeyBoy Jun 2013)
Wizard Spider	Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.(Citation: CrowdStrike Grim Spider May 2019)(Citation: Mandiant FIN12 Oct 2021)
Elise	Elise configures itself as a service.(Citation: Lotus Blossom Jun 2015)
Okrum	To establish persistence, Okrum can install itself as a new service named NtmSsvc.(Citation: ESET Okrum July 2019)
Blue Mockingbird	Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.(Citation: RedCanary Mockingbird May 2020)
TeamTNT	TeamTNT has used malware that adds cryptocurrency miners as a service.(Citation: ATT TeamTNT Chimaera September 2020)
AppleJeus	AppleJeus can install itself as a service.(Citation: CISA AppleJeus Feb 2021)
Dtrack	Dtrack can add a service called WBService to establish persistence.(Citation: CyberBit Dtrack)
Stuxnet	Stuxnet uses a driver registered as a boot start service as the main load-point.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)
zwShell	zwShell has established persistence by adding itself as a new service.(Citation: McAfee Night Dragon)
SILENTTRINITY	SILENTTRINITY can establish persistence by creating a new service.(Citation: GitHub SILENTTRINITY Modules July 2019)
ZLib	ZLib creates Registry keys to allow itself to run as various services.(Citation: Cylance Dust Storm)
Bisonal	Bisonal has been modified to be used as a Windows service.(Citation: Talos Bisonal Mar 2020)
	APT41 DUST used Windows Services with names such as `Windows Defend` for persistence of DUSTPAN.(Citation: Google Cloud APT41 2024)
PsExec	PsExec can leverage Windows services to escalate privileges from administrator to SYSTEM with the `-s` argument.(Citation: Russinovich Sysinternals)
ThreatNeedle	ThreatNeedle can run in memory and register its payload as a Windows service.(Citation: Kaspersky ThreatNeedle Feb 2021)
Duqu	Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.(Citation: Symantec W32.Duqu)
APT19	An APT19 Port 22 malware variant registers itself as a service.(Citation: Unit 42 C0d0so0 Jan 2016)
Shamoon	Shamoon creates a new service named “ntssrv” to execute the payload. Newer versions create the "MaintenaceSrv" and "hdv_725x" services.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)
TrickBot	TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.(Citation: Trend Micro Trickbot Nov 2018)
StreamEx	StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.(Citation: Cylance Shell Crew Feb 2017)
Kwampirs	Kwampirs creates a new service named WmiApSrvEx to establish persistence.(Citation: Symantec Orangeworm April 2018)
SLOTHFULMEDIA	SLOTHFULMEDIA has created a service on victim machines named "TaskFrame" to establish persistence.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
Bankshot	Bankshot can terminate a specific process by its process id.(Citation: McAfee Bankshot)(Citation: US-CERT Bankshot Dec 2017)
Cobalt Strike	Cobalt Strike can install a new service.(Citation: Cobalt Strike TTPs Dec 2017)
Pandora	Pandora has the ability to gain system privileges through Windows services.(Citation: Trend Micro Iron Tiger April 2021)
RDAT	RDAT has created a service when it is installed on the victim machine.(Citation: Unit42 RDAT July 2020)
PowerSploit	PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)
Carbon	Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine.(Citation: ESET Carbon Mar 2017)
Threat Group-3390	Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Lunghi Iron Tiger Linux)
Wiarp	Wiarp creates a backdoor through which remote attackers can create a service.(Citation: Symantec Wiarp May 2012)
Nerex	Nerex creates a Registry subkey that registers a new service.(Citation: Symantec Nerex May 2012)
Catchamas	Catchamas adds a new service named NetAdapter to establish persistence.(Citation: Symantec Catchamas April 2018)
Samurai	Samurai can create a service at `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost` to trigger execution and maintain persistence.(Citation: Kaspersky ToddyCat June 2022)
Hydraq	Hydraq creates new services to establish persistence.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)(Citation: Symantec Hydraq Persistence Jan 2010)
PlugX	PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.(Citation: CIRCL PlugX March 2013)(Citation: Lastline PlugX Analysis)(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)(Citation: Proofpoint ZeroT Feb 2017)
Ke3chang	Ke3chang backdoor RoyalDNS established persistence through adding a service called `Nwsapagent`.(Citation: NCC Group APT15 Alive and Strong)
LoudMiner	LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.(Citation: ESET LoudMiner June 2019)
PROMETHIUM	PROMETHIUM has created new services and modified existing services for persistence.(Citation: Bitdefender StrongPity June 2020)
Attor	Attor's dispatcher can establish persistence by registering a new service.(Citation: ESET Attor Oct 2019)
Kazuar	Kazuar can install itself as a new service.(Citation: Unit 42 Kazuar May 2017)
Ursnif	Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.(Citation: TrendMicro PE_URSNIF.A2)
SUGARUSH	SUGARUSH has created a service named `Service1` for persistence.(Citation: Mandiant UNC3890 Aug 2022)
	During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary. (Citation: Dragos Crashoverride 2017)
hcdLoader	hcdLoader installs itself as a service for persistence.(Citation: Dell Lateral Movement)(Citation: ThreatStream Evasion Analysis)
BitPaymer	BitPaymer has attempted to install itself as a service to maintain persistence.(Citation: Crowdstrike Indrik November 2018)
PingPull	PingPull has the ability to install itself as a service.(Citation: Unit 42 PingPull Jun 2022)
TinyZBot	TinyZBot can install as a Windows service for persistence.(Citation: Cylance Cleaver)
Exaramel for Windows	The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV.”(Citation: ESET TeleBots Oct 2018)
Anchor	Anchor can establish persistence by creating a service.(Citation: Cyberreason Anchor December 2019)
KONNI	KONNI has registered itself as a service using its export function.(Citation: Malwarebytes Konni Aug 2021)
ZxShell	ZxShell can create a new service using the service parser function ProcessScCommand.(Citation: Talos ZxShell Oct 2014)
RainyDay	RainyDay can use services to establish persistence.(Citation: Bitdefender Naikon April 2021)
BBSRAT	BBSRAT can modify service configurations.(Citation: Palo Alto Networks BBSRAT)
InvisiMole	InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.(Citation: ESET InvisiMole June 2020)
APT32	APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.(Citation: ESET OceanLotus)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)
TEARDROP	TEARDROP ran as a Windows service from the `c:\windows\syswow64` folder.(Citation: Check Point Sunburst Teardrop December 2020)(Citation: FireEye SUNBURST Backdoor December 2020)
Nebulae	Nebulae can create a service to establish persistence.(Citation: Bitdefender Naikon April 2021)
FinFisher	FinFisher creates a new Windows service with the malicious executable for persistence.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
StrongPity	StrongPity has created new services and modified existing services for persistence.(Citation: Talos Promethium June 2020)
Black Basta	Black Basta can create a new service to establish persistence.(Citation: Minerva Labs Black Basta May 2022)(Citation: Avertium Black Basta June 2022)
Seasalt	Seasalt is capable of installing itself as a service.(Citation: Mandiant APT1 Appendix)
Wingbird	Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.(Citation: Microsoft SIR Vol 21)(Citation: Microsoft Wingbird Nov 2017)
	During Operation Honeybee, threat actors installed DLLs and backdoors as Windows services.(Citation: McAfee Honeybee)
gh0st RAT	gh0st RAT can create a new service to establish persistence.(Citation: Nccgroup Gh0st April 2018)(Citation: Gh0stRAT ATT March 2019)
Carbanak	Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.(Citation: Kaspersky Carbanak)
Uroburos	Uroburos has registered a service, typically named `WerFaultSvc`, to decrypt and find a kernel driver and kernel driver loader to maintain persistence.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
JHUHUGIT	JHUHUGIT has registered itself as a service to establish persistence.(Citation: ESET Sednit Part 1)
Naid	Naid creates a new service to establish.(Citation: Symantec Naid June 2012)
Ragnar Locker	Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.(Citation: Sophos Ragnar May 2020)
Ninja	Ninja can create the services `httpsvc` and `w3esvc` for persistence .(Citation: Kaspersky ToddyCat June 2022)
APT3	APT3 has a tool that creates a new service for persistence.(Citation: FireEye Operation Double Tap)
FIN7	FIN7 created new Windows services and added them to the startup directories for persistence.(Citation: FireEye FIN7 Aug 2018)
InnaputRAT	Some InnaputRAT variants create a new Windows service to establish persistence.(Citation: ASERT InnaputRAT April 2018)
Agrius	Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence.(Citation: SentinelOne Agrius 2021)
BlackEnergy	One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.(Citation: F-Secure BlackEnergy 2014)
Kimsuky	Kimsuky has created new services for persistence.(Citation: Securelist Kimsuky Sept 2013)(Citation: CISA AA20-301A Kimsuky)
ShimRat	ShimRat has installed a Windows service to maintain persistence on victim machines.(Citation: FOX-IT May 2016 Mofang)
CozyCar	One persistence mechanism used by CozyCar is to register itself as a Windows service.(Citation: F-Secure CozyDuke)
Clambling	Clambling can register itself as a system service to gain persistence.(Citation: Talent-Jump Clambling February 2020)
TYPEFRAME	TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine.(Citation: US-CERT TYPEFRAME June 2018)
HermeticWiper	HermeticWiper can load drivers by creating a new service using the `CreateServiceW` API.(Citation: Crowdstrike DriveSlayer February 2022)
Earth Lusca	Earth Lusca created a service using the command `sc create “SysUpdate” binpath= “cmd /c start “[file path]””&&sc config “SysUpdate” start= auto&&net start SysUpdate` for persistence.(Citation: TrendMicro EarthLusca 2022)
RawPOS	RawPOS installs itself as a service to maintain persistence.(Citation: Kroll RawPOS Jan 2017)(Citation: TrendMicro RawPOS April 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016)
Cobalt Strike	Cobalt Strike can install a new service.(Citation: Cobalt Strike TTPs Dec 2017)
Cobalt Group	Cobalt Group has created new services to establish persistence.(Citation: Group IB Cobalt Aug 2017)
Sakula	Some Sakula samples install themselves as services for persistence by calling WinExec with the `net start` argument.(Citation: Dell Sakula)
TDTESS	If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.(Citation: ClearSky Wilted Tulip July 2017)
Lazarus Group	Several Lazarus Group malware families install themselves as new services.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)
AuditCred	AuditCred is installed as a new service on the system.(Citation: TrendMicro Lazarus Nov 2018)
PipeMon	PipeMon can establish persistence by registering a malicious DLL as an alternative Print Processor which is loaded when the print spooler service starts.(Citation: ESET PipeMon May 2020)
Cinnamon Tempest	Cinnamon Tempest has created system services to establish persistence for deployed tooling.(Citation: Sygnia Emperor Dragonfly October 2022)
Dyre	Dyre registers itself as a service by adding several Registry keys.(Citation: Symantec Dyre June 2015)
Emissary	Emissary is capable of configuring itself as a service.(Citation: Emissary Trojan Feb 2016)
Empire	Empire can utilize built-in modules to modify service binaries and restore them to their original state.(Citation: Github PowerShell Empire)
Emotet	Emotet has been observed creating new services to maintain persistence.(Citation: US-CERT Emotet Jul 2018)(Citation: Secureworks Emotet Nov 2018)(Citation: Binary Defense Emotes Wi-Fi Spreader)
DUSTPAN	DUSTPAN can persist as a Windows Service in operations.(Citation: Google Cloud APT41 2024)
Reaver	Reaver installs itself as a new service.(Citation: Palo Alto Reaver Nov 2017)
FALLCHILL	FALLCHILL has been installed as a Windows service.(Citation: CISA AppleJeus Feb 2021)
SysUpdate	SysUpdate can create a service to establish persistence.(Citation: Trend Micro Iron Tiger April 2021)
Nidiran	Nidiran can create a new service named msamger (Microsoft Security Accounts Manager).(Citation: Symantec Backdoor.Nidiran)
WannaCry	WannaCry creates the service "mssecsvc2.0" with the display name "Microsoft Security Center (2.0) Service."(Citation: LogRhythm WannaCry)(Citation: FireEye WannaCry 2017)

Контрмера	Описание
Контрмеры
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.
Operating System Configuration	Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.
Audit	Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
Code Signing	Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.
User Account Management	Manage the creation, modification, use, and permissions associated to user accounts.

Обнаружение

Monitor processes and command-line arguments for actions that could create or modify services. Command-line invocation of tools capable of adding or modifying services may be unusual, depending on how systems are typically used in a particular environment. Services may also be modified through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data. Remote access tools with built-in features may also interact directly with the Windows API to perform these functions outside of typical system utilities. Collect service utility execution and service binary path arguments used for analysis. Service binary paths may even be changed to execute commands or scripts. Look for changes to service Registry entries that do not correlate with known software, patch cycles, etc. Service information is stored in the Registry at HKLM\SYSTEM\CurrentControlSet\Services. Changes to the binary path and the service startup type changed from manual or disabled to automatic, if it does not typically do so, may be suspicious. Tools such as Sysinternals Autoruns may also be used to detect system service changes that could be attempts at persistence.(Citation: TechNet Autoruns) Creation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017)(Citation: Microsoft Windows Event Forwarding FEB 2018)). New, benign services may be created during installation of new software. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data. Look for abnormal process call trees from known services and for execution of other commands that could relate to Discovery or other adversary techniques. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

Ссылки

Связанные риски

Риск	Связи
Закрепление злоумышленника в ОС из-за возможности создания или изменения службы Windows в ОС Windows Повышение привилегий НСД

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.