自动化接入 · API / MCP EN

技术说明 · T1543.003

Windows Service

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API. Adversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via Native API functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. Modify Registry), or by using command-line utilities such as `PnPUtil.exe`. Adversaries may leverage these drivers as Rootkits to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of Exploitation for Privilege Escalation. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through Service Execution. To make detection analysis more challenging, malicious services may also incorporate Masquerade Task or Service (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create ‘hidden’ services (i.e., Hide Artifacts), for example by using the `sc sdset` command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as `Get-Service`, `sc query`, and `services.exe`.

ATT&CK T1543.003 platforms — 状态 有效 版本 20.1

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.1 Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API. Adversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via Native API functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. Modify Registry), or by using command-line utilities such as `PnPUtil.exe`.234 Adversaries may leverage these drivers as Rootkits to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of Exploitation for Privilege Escalation.56 Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through Service Execution. To make detection analysis more challenging, malicious services may also incorporate Masquerade Task or Service (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create ‘hidden’ services (i.e., Hide Artifacts), for example by using the `sc sdset` command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as `Get-Service`, `sc query`, and `services.exe`.78

  1. TechNet Services
  2. Symantec W.32 Stuxnet Dossier
  3. Crowdstrike DriveSlayer February 2022
  4. Unit42 AcidBox June 2020
  5. ESET InvisiMole June 2020
  6. Unit42 AcidBox June 2020
  7. SANS 1
  8. SANS 2

使用该技术的组织

组织名称国家
grp_g0105DarkVishnya—
grp_g1030AgriusIran
grp_g0056PROMETHIUM—
grp_g1043BlackByte—
grp_g0108Blue Mockingbird—
grp_g0143Aquatic PandaChina
grp_g0032Lazarus GroupDPRK
grp_g1021Cinnamon TempestChina
grp_g0004Ke3chang—
grp_g1051Medusa Group—
grp_g0080Cobalt Group—
grp_g0008Carbanak—
grp_g0102Wizard SpiderRussia
grp_g0049OilRigIran
grp_g0073APT19China
grp_g0082APT38DPRK
grp_g0081Tropic Trooper—
grp_g0046FIN7—
grp_g0022APT3China
grp_g0030Lotus Blossom—
grp_g0094KimsukyDPRK
grp_g0139TeamTNT—
grp_g0096APT41China
grp_g1006Earth LuscaChina
grp_g0027Threat Group-3390China
grp_g0050APT32Vietnam

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。