MITRE ATT&CK - Техника Диспетчер управления службами

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

System Services: Диспетчер управления службами

Other sub-techniques of System Services (2)

ID	Название
.001	Утилита launchctl
.002	Диспетчер управления службами

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as PsExec and sc.exe can accept remote servers as arguments and may be used to conduct remote execution. Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation.

ID: T1569.002

Относится к технике: T1569

Тактика(-и): Execution

Платформы: Windows

Требуемые разрешения: Administrator, SYSTEM

Источники данных: Command: Command Execution, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification

Версия: 1.1

Дата создания: 10 Mar 2020

Последнее изменение: 30 Aug 2021

Название	Описание
Примеры процедур
Pupy	Pupy uses PsExec to execute a payload or commands on a remote host.(Citation: GitHub Pupy)
Cobalt Strike	Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.(Citation: cobaltstrike manual)(Citation: Cobalt Strike TTPs Dec 2017)(Citation: Cobalt Strike Manual 4.3 November 2020)
InvisiMole	InvisiMole has used Windows services as a way to execute its malicious payload.(Citation: ESET InvisiMole June 2020)
Hydraq	Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.(Citation: Symantec Hydraq Persistence Jan 2010)
Honeybee	Honeybee launches a DLL file that gets executed as a service using svchost.exe(Citation: McAfee Honeybee)
NotPetya	NotPetya can use PsExec to help propagate itself across a network.(Citation: Talos Nyetya June 2017)(Citation: US-CERT NotPetya 2017)
Chimera	Chimera has used PsExec to deploy beacons on compromised systems.(Citation: NCC Group Chimera January 2021)
RemoteCMD	RemoteCMD can execute commands remotely by creating a new service on the remote system.(Citation: Symantec Buckeye)
HermeticWizard	HermeticWizard can use `OpenRemoteServiceManager` to create a service.(Citation: ESET Hermetic Wizard March 2022)
TinyTurla	TinyTurla can install itself as a service on compromised machines.(Citation: Talos TinyTurla September 2021)
Bad Rabbit	Bad Rabbit drops a file named `infpub.dat`into the Windows directory and is executed through SCManager and `rundll.exe`.
Ragnar Locker	Ragnar Locker has used sc.exe to execute a service that it creates.(Citation: Sophos Ragnar May 2020)
APT39	APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.(Citation: BitDefender Chafer May 2020)(Citation: Symantec Chafer February 2018)
PoshC2	PoshC2 contains an implementation of PsExec for remote execution.(Citation: GitHub PoshC2)
xCmd	xCmd can be used to execute binaries on remote systems by creating and starting a service.(Citation: xCmd)
	During Operation Wocao, threat actors created services on remote systems for execution purposes.(Citation: FoxIT Wocao December 2019)
Winexe	Winexe installs a service on the remote system, executes the command, then uninstalls the service.(Citation: Secpod Winexe June 2017)
BBSRAT	BBSRAT can start, stop, or delete services.(Citation: Palo Alto Networks BBSRAT)
Clambling	Clambling can create and start services on a compromised host.(Citation: Trend Micro DRBControl February 2020)
Proxysvc	Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.(Citation: McAfee GhostSecret)
Net	The `net start` and `net stop` commands can be used in Net to execute or stop Windows services.(Citation: Savill 1999)
SLOTHFULMEDIA	SLOTHFULMEDIA has the capability to start services.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
gh0st RAT	gh0st RAT can execute its service if the Service key exists. If the key does not exist, gh0st RAT will create and run the service.(Citation: Gh0stRAT ATT March 2019)
Impacket	Impacket contains various modules emulating other service execution tools such as PsExec.(Citation: Impacket Tools)
HyperBro	HyperBro has the ability to start and stop a specified service.(Citation: Unit42 Emissary Panda May 2019)
Shamoon	Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec.(Citation: Palo Alto Shamoon Nov 2016)(Citation: McAfee Shamoon December19 2018)
Empire	Empire can use PsExec to execute a payload on a remote host.(Citation: Github PowerShell Empire)
Okrum	Okrum's loader can create a new service named NtmsSvc to execute the payload.(Citation: ESET Okrum July 2019)
APT41	APT41 used svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.(Citation: FireEye APT41 March 2020)(Citation: Group IB APT 41 June 2021)
Silence	Silence has used Winexe to install a service on the remote system.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)
Ke3chang	Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.(Citation: NCC Group APT15 Alive and Strong)
Blue Mockingbird	Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.(Citation: RedCanary Mockingbird May 2020)
HOPLIGHT	HOPLIGHT has used svchost.exe to execute a malicious DLL .(Citation: US-CERT HOPLIGHT Apr 2019)
WhisperGate	WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.(Citation: Medium S2W WhisperGate January 2022)(Citation: Unit 42 WhisperGate January 2022)
Wingbird	Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.(Citation: Microsoft SIR Vol 21)(Citation: Microsoft Wingbird Nov 2017)
Net Crawler	Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.(Citation: Cylance Cleaver)
LoudMiner	LoudMiner started the cryptomining virtual machine as a service on the infected machine.(Citation: ESET LoudMiner June 2019)
Pysa	Pysa has used PsExec to copy and execute the ransomware.(Citation: CERT-FR PYSA April 2020)
	During Operation Honeybee, threat actors ran `sc start` to start the COMSysApp as part of the service hijacking and `sc stop` to stop and reconfigure the COMSysApp.(Citation: McAfee Honeybee)
Winnti for Windows	Winnti for Windows can run as a service using svchost.exe.(Citation: Novetta Winnti April 2015)
APT32	APT32's backdoor has used Windows services as a way to execute its malicious payload. (Citation: ESET OceanLotus Mar 2019)
Pandora	Pandora has the ability to install itself as a Windows service.(Citation: Trend Micro Iron Tiger April 2021)
PsExec	Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.(Citation: Russinovich Sysinternals)
Koadic	Koadic can run a command on another machine using PsExec.(Citation: Github Koadic)
FIN6	FIN6 has created Windows services to execute encoded PowerShell commands.(Citation: FireEye FIN6 Apr 2019)
Attor	Attor's dispatcher can be executed as a service.(Citation: ESET Attor Oct 2019)
Olympic Destroyer	Olympic Destroyer utilizes PsExec to help propagate itself across a network.(Citation: Talos Olympic Destroyer 2018)
WastedLocker	WastedLocker can execute itself as a service.(Citation: NCC Group WastedLocker June 2020)
Cobalt Strike	Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.(Citation: cobaltstrike manual)(Citation: Cobalt Strike TTPs Dec 2017)
HermeticWiper	HermeticWiper can create system services to aid in executing the payload.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Qualys Hermetic Wiper March 2022)
Netwalker	Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.(Citation: Sophos Netwalker May 2020)
Operation Wocao	Operation Wocao has created services on remote systems for execution purposes.(Citation: FoxIT Wocao December 2019)
StrongPity	StrongPity can install a service to execute itself as a service.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
SysUpdate	SysUpdate can manage services and processes.(Citation: Trend Micro Iron Tiger April 2021)
ZxShell	ZxShell can create a new service for execution.(Citation: Talos ZxShell Oct 2014)
APT38	APT38 has created new services or modified existing ones to run executables, commands, or scripts.(Citation: CISA AA20-239A BeagleBoyz August 2020)
Wizard Spider	Wizard Spider has used services.exe to execute scripts and executables during lateral movement within a victim network.(Citation: DFIR Ryuk's Return October 2020)(Citation: DFIR Ryuk in 5 Hours October 2020)
Anchor	Anchor can create and execute services to load its payload.(Citation: Cyberreason Anchor December 2019)(Citation: Medium Anchor DNS July 2020)

Контрмера	Описание
Контрмеры
Privileged Account Management	Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.
Restrict File and Directory Permissions	Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.

Обнаружение

Changes to service Registry entries and command line invocation of tools capable of modifying services that do not correlate with known software, patch cycles, etc., may be suspicious. If a service is used only to execute a binary or script and not to persist, then it will likely be changed back to its original form shortly after the service is restarted so the service is not left broken, as is the case with the common administrator tool PsExec.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.