Check out the results from our first round of ATT&CK Evaluations at attackevals.mitre.org!

New Service

When operating systems boot up, they can start programs or applications called services that perform background system functions. [1] A service's configuration information, including the file path to the service's executable, is stored in the Windows Registry.

Adversaries may install a new service that can be configured to execute at startup by using utilities to interact with services or by directly modifying the Registry. The service name may be disguised by using a name from a related operating system or benign software with Masquerading. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. Adversaries may also directly start services through Service Execution.

ID: T1050

Tactic: Persistence, Privilege Escalation

Platform:  Windows

Permissions Required:  Administrator, SYSTEM

Effective Permissions:  SYSTEM

Data Sources:  Windows Registry, Process monitoring, Process command-line parameters, Windows event logs

CAPEC ID:  CAPEC-550

Contributors:  Pedro Harrison

Version: 1.0

Examples

NameDescription
APT3

APT3 has a tool that creates a new service for persistence.[2]

APT32

APT32 creates a Windows service to establish persistence.[3]

BlackEnergy

One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.[4]

Briba

Briba installs a service pointing to a malicious DLL dropped to disk.[5]

Carbanak

Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.[6]

Catchamas

Catchamas adds a new service named NetAdapter to establish persistence.[7]

Cobalt Group

Cobalt Group has created new services to establish persistence.[8]

Cobalt Strike

Cobalt Strike can install a new service.[9]

CosmicDuke

CosmicDuke uses Windows services typically named "javamtsup" for persistence.[10]

CozyCar

One persistence mechanism used by CozyCar is to register itself as a Windows service.[11]

Duqu

Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.[12]

Dyre

Dyre registers itself as a service by adding several Registry keys.[13]

Elise

Elise configures itself as a service.[14]

Emissary

Emissary is capable of configuring itself as a service.[15]

FIN7

FIN7 created new Windows services and added them to the startup directories for persistence.[16]

FinFisher

FinFisher creates a new Windows service with the malicious executable for persistence.[17][18]

hcdLoader

hcdLoader installs itself as a service for persistence.[19][20]

Hydraq

Hydraq creates new services to establish persistence.[21][22][23]

InnaputRAT

Some InnaputRAT variants create a new Windows service to establish persistence.[24]

JHUHUGIT

JHUHUGIT has registered itself as a service to establish persistence.[25]

Kazuar

Kazuar can install itself as a new service.[26]

Ke3chang

Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.[27]

Kwampirs

Kwampirs creates a new service named WmiApSrvEx to establish persistence.[28]

Lazarus Group

Several Lazarus Group malware families install themselves as new services on victims.[29][30]

MoonWind

MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.[31]

Naid

Naid creates a new service to establish.[32]

Nerex

Nerex creates a Registry subkey that registers a new service.[33]

Nidiran

Nidiran can create a new service named msamger (Microsoft Security Accounts Manager).[34]

PlugX

PlugX can be added as a service to establish persistence.[35][36][37][38]

PoisonIvy

PoisonIvy creates a Registry subkey that registers a new service.[39]

RawPOS

RawPOS installs itself as a service to maintain persistence.[40][41][42]

Reaver

Reaver installs itself as a new service.[43]

Sakula

Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument.[44]

Shamoon

Shamoon creates a new service named "ntssrv" to execute the payload.[45]

StreamEx

StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.[46]

TDTESS

If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.[47]

Threat Group-3390

A Threat Group-3390 tool can create a new service, naming it after the config information, to gain persistence.[48]

TinyZBot

TinyZBot can install as a Windows service for persistence.[49]

TYPEFRAME

TYPEFRAME variants can add malicious DLL modules as new services.[50]

Volgmer

Some Volgmer variants install .dll files as services with names generated by a list of hard-coded strings.[51][52]

Wiarp

Wiarp creates a backdoor through which remote attackers can create a service.[53]

Wingbird

Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.[54][55]

Winnti

Winnti sets its DLL file as a new service in the Registry to establish persistence.[56]

ZeroT

ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.[38]

ZLib

ZLib creates Registry keys to allow itself to run as various services.[57]

Mitigation

Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create new services.

Identify and block unnecessary system utilities or potentially malicious software that may be used to create services by using whitelisting [58] tools, like AppLocker, [59] [60] or Software Restriction Policies [61] where appropriate. [62]

Detection

Monitor service creation through changes in the Registry and common utilities using command-line invocation. Creation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 [63] [64]). New, benign services may be created during installation of new software. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence. [65] Look for changes to services that do not correlate with known software, patch cycles, etc. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.

Monitor processes and command-line arguments for actions that could create services. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Services may also be created through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.

References

  1. Microsoft. (n.d.). Services. Retrieved June 7, 2016.
  2. Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.
  3. Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using old tricks. Retrieved May 22, 2018.
  4. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.
  5. Ladley, F. (2012, May 15). Backdoor.Briba. Retrieved February 21, 2018.
  6. Kaspersky Lab's Global Research and Analysis Team. (2015, February). CARBANAK APT THE GREAT BANK ROBBERY. Retrieved August 23, 2018.
  7. Balanza, M. (2018, April 02). Infostealer.Catchamas. Retrieved July 10, 2018.
  8. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.
  9. Cobalt Strike. (2017, December 8). Tactics, Techniques, and Procedures. Retrieved December 20, 2017.
  10. F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
  11. F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.
  12. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  13. Symantec Security Response. (2015, June 23). Dyre: Emerging threat on financial fraud landscape. Retrieved August 23, 2018.
  14. Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.
  15. Falcone, R. and Miller-Osborn, J.. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.
  16. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.
  17. FinFisher. (n.d.). Retrieved December 20, 2017.
  18. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  19. Carvey, H.. (2014, September 2). Where you AT?: Indicators of lateral movement using at.exe on Windows 7 systems. Retrieved January 25, 2016.
  20. Shelmire, A.. (2015, July 6). Evasive Maneuvers. Retrieved January 22, 2016.
  21. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  22. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  23. Fitzgerald, P. (2010, January 26). How Trojan.Hydraq Stays On Your Computer. Retrieved February 22, 2018.
  24. ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018.
  25. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
  26. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  27. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  28. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  29. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  30. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.
  31. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  32. Neville, A. (2012, June 15). Trojan.Naid. Retrieved February 22, 2018.
  33. Ladley, F. (2012, May 15). Backdoor.Nerex. Retrieved February 23, 2018.
  1. Sponchioni, R.. (2016, March 11). Backdoor.Nidiran. Retrieved August 3, 2016.
  2. Vasilenko, R. (2013, December 17). An Analysis of PlugX Malware. Retrieved November 24, 2015.
  3. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  4. FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.
  5. Huss, D., et al. (2017, February 2). Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX. Retrieved April 5, 2018.
  6. Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.
  7. Nesbit, B. and Ackerman, D. (2017, January). Malware Analysis Report - RawPOS Malware: Deconstructing an Intruder’s Toolkit. Retrieved October 4, 2017.
  8. TrendLabs Security Intelligence Blog. (2015, April). RawPOS Technical Brief. Retrieved October 4, 2017.
  9. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  10. Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
  11. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, July 30). Sakula Malware Family. Retrieved January 26, 2016.
  12. Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.
  13. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.
  14. ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.
  15. Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018.
  16. Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.
  17. US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.
  18. US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.
  19. Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.
  20. Zhou, R. (2012, May 15). Backdoor.Wiarp. Retrieved February 22, 2018.
  21. Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.
  22. Microsoft. (2017, November 9). Backdoor:Win32/Wingbird.A!dha. Retrieved November 27, 2017.
  23. Cap, P., et al. (2017, January 25). Detecting threat actors in recent German industrial attacks with Windows Defender ATP. Retrieved February 8, 2017.
  24. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved September 19, 2017.
  25. Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
  26. Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
  27. NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
  28. Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
  29. Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.
  30. Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service was installed in the system. Retrieved August 7, 2018.
  31. Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding to help with intrusion detection. Retrieved August 7, 2018.
  32. Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.