Create or Modify System Process: Windows Service

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary. ^[8]

Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence.^[9]

Anchor can establish persistence by creating a service.^[10]

AppleJeus can install itself as a service.^[11]

An APT19 Port 22 malware variant registers itself as a service.^[12]

APT3 has a tool that creates a new service for persistence.^[13]

APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.^[14][15][16]

APT38 has installed a new Windows service to establish persistence.^[17]

APT41 modified legitimate Windows services to install malware backdoors.^[18][19] APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.^[20]

APT41 DUST used Windows Services with names such as Windows Defend for persistence of DUSTPAN.^[21]

Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.^[22]

Attor's dispatcher can establish persistence by registering a new service.^[23]

AuditCred is installed as a new service on the system.^[24]

Bankshot can terminate a specific process by its process id.^[25][26]

BBSRAT can modify service configurations.^[27]

Bisonal has been modified to be used as a Windows service.^[28]

BitPaymer has attempted to install itself as a service to maintain persistence.^[29]

Black Basta can create a new service to establish persistence.^[30][31]

BlackByte modified multiple services on victim machines to enable encryption operations.^[32] BlackByte has installed tools such as AnyDesk as a service on victim machines.^[33]

One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.^[34]

Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.^[35]

BOOKWORM has created a service named Microsoft Windows DeviceSync Service at HKLM\SYSTEM\CurrentControlSet\Services\DeviceSync\ to trigger execution when the system starts and to maintain persistence. ^[36]

Briba installs a service pointing to a malicious DLL dropped to disk.^[37]

Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.^[38]

Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine.^[39]

Catchamas adds a new service named NetAdapter to establish persistence.^[40]

Cinnamon Tempest has created system services to establish persistence for deployed tooling.^[41]

Clambling can register itself as a system service to gain persistence.^[42]

Cobalt Group has created new services to establish persistence.^[43]

Cobalt Strike can install a new service.^[44]

Conficker copies itself into the %systemroot%\system32 directory and registers as a service.^[45]

CorKLOG has created a service to establish persistence.^[46]

CosmicDuke uses Windows services typically named "javamtsup" for persistence.^[47]

One persistence mechanism used by CozyCar is to register itself as a Windows service.^[48]

Cuba can modify services by using the OpenService and ChangeServiceConfig functions.^[49]

DarkVishnya created new services for shellcode loaders distribution.^[50]

DCSrv has created new services for persistence by modifying the Registry.^[51]

Dtrack can add a service called WBService to establish persistence.^[52]

Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.^[53]

DUSTPAN can persist as a Windows Service in operations.^[21]

Dyre registers itself as a service by adding several Registry keys.^[54]

Earth Lusca created a service using the command sc create "SysUpdate" binpath= "cmd /c start "[file path]""&&sc config "SysUpdate" start= auto&&net
start SysUpdate for persistence.^[55]

Elise configures itself as a service.^[56]

Embargo has created persistence through the DLL variant of the MDeployer toolkit by creating a service called irnagentd that launches after the system is rebooted in Safe Mode.^[57]

Emissary is capable of configuring itself as a service.^[58]

Emotet has been observed creating new services to maintain persistence.^[59][60][61]

Empire can utilize built-in modules to modify service binaries and restore them to their original state.^[62]

The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description "Windows Check AV."^[63]

FALLCHILL has been installed as a Windows service.^[11]

FIN7 created new Windows services and added them to the startup directories for persistence.^[64]

FinFisher creates a new Windows service with the malicious executable for persistence.^[65][66]

FunnyDream has established persistence by running sc.exe and by setting the WSearch service to run automatically.^[67]

Gelsemium can drop itself in C:\Windows\System32\spool\prtprocs\x64\winprint.dll as an alternative Print Processor to be loaded automatically when the spoolsv Windows service starts.^[68]

gh0st RAT can create a new service to establish persistence.^[69][70]

GoldenSpy has established persistence by running in the background as an autostart service.^[71]

GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.^[72]

Hannotog creates a new service for persistence.^[73]

hcdLoader installs itself as a service for persistence.^[74][75]

HermeticWiper can load drivers by creating a new service using the CreateServiceW API.^[3]

Hydraq creates new services to establish persistence.^[76][77][78]

Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.^[8]

Some InnaputRAT variants create a new Windows service to establish persistence.^[79]

InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.^[5]

JHUHUGIT has registered itself as a service to establish persistence.^[80]

Kazuar can install itself as a new service.^[81]

Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.^[82]

KeyBoy installs a service pointing to a malicious DLL dropped to disk.^[83]

Kimsuky has created new services for persistence.^[84][85]

KONNI has registered itself as a service using its export function.^[86]

Kwampirs creates a new service named WmiApSrvEx to establish persistence.^[87]

Several Lazarus Group malware families install themselves as new services.^[88][89]

LockBit 3.0 can install system services for persistence.^[90]

Lotus Blossom has configured tools such as Sagerunex to run as Windows services.^[91]

LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.^[92]

Medusa Group has used vulnerable or signed drivers to modify security solutions on victim devices.^[93]

Medusa Ransomware has created a new PowerShell process using the CreateProcessA API.^[94]

MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.^[95]

Naid creates a new service to establish.^[96]

Nebulae can create a service to establish persistence.^[97]

Nerex creates a Registry subkey that registers a new service.^[98]

Nidiran can create a new service named msamger (Microsoft Security Accounts Manager).^[99]

NightClub has created a Windows service named WmdmPmSp to establish persistence.^[100]

Ninja can create the services httpsvc and w3esvc for persistence .^[101]

OilRig has used a compromised Domain Controller to create a service on a remote host.^[102]

To establish persistence, Okrum can install itself as a new service named NtmSsvc.^[103]

During Operation CuckooBees, the threat actors modified the IKEEXT and PrintNotify Windows services for persistence.^[104]

During Operation Honeybee, threat actors installed DLLs and backdoors as Windows services.^[105]

Pandora has the ability to gain system privileges through Windows services.^[106]

PingPull has the ability to install itself as a service.^[107]

PipeMon can establish persistence by registering a malicious DLL as an alternative Print Processor which is loaded when the print spooler service starts.^[108]

PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.^{[109][110][111][112][113]}

PoisonIvy creates a Registry subkey that registers a new service. PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.^[114]

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.^[115][116]

PROMETHIUM has created new services and modified existing services for persistence.^[117]

PsExec can leverage Windows services to escalate privileges from administrator to SYSTEM with the -s argument.^[118]

QakBot can remotely create a temporary service on a target host.^[119]

Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.^[120]

RainyDay can use services to establish persistence.^[97]

RawPOS installs itself as a service to maintain persistence.^{[121][122][123]}

RDAT has created a service when it is installed on the victim machine.^[124]

Reaver installs itself as a new service.^[125]

Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument.^[126]

Samurai can create a service at HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost to trigger execution and maintain persistence.^[101]

Seasalt is capable of installing itself as a service.^[127]

Shamoon creates a new service named "ntssrv" to execute the payload. Newer versions create the "MaintenaceSrv" and "hdv_725x" services.^[128][129]

ShimRat has installed a Windows service to maintain persistence on victim machines.^[130]

SILENTTRINITY can establish persistence by creating a new service.^[131]

SLOTHFULMEDIA has created a service on victim machines named "TaskFrame" to establish persistence.^[132]

SplatDropper has created a service to execute a payload.^[46]

STARWHALE has the ability to create the following Windows service to establish persistence on an infected host: sc create Windowscarpstss binpath= "cmd.exe /c cscript.exe c:\\windows\\system32\\w7_1.wsf humpback_whale" start= "auto" obj= "LocalSystem".^[133]

StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.^[134]

StrongPity has created new services and modified existing services for persistence.^[135]

Stuxnet uses a driver registered as a boot start service as the main load-point.^[136]

SUGARUSH has created a service named Service1 for persistence.^[137]

SysUpdate can create a service to establish persistence.^[106]

If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.^[138]

TeamTNT has used malware that adds cryptocurrency miners as a service.^[139]

TEARDROP ran as a Windows service from the c:\windows\syswow64 folder.^[140][141]

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.^[142][143]

ThreatNeedle can run in memory and register its payload as a Windows service.^[144]

TinyZBot can install as a Windows service for persistence.^[145]

TONESHELL has created a malicious service DISMsrv to maintain persistence.^[146]

TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.^[147]

Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.^[148]

TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine.^[149]

Uroburos has registered a service, typically named WerFaultSvc, to decrypt and find a kernel driver and kernel driver loader to maintain persistence.^[150]

Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.^[151]

Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.^{[152][153][154]}

WannaCry creates the service "mssecsvc2.0" with the display name "Microsoft Security Center (2.0) Service."^[155][156]

WastedLocker created and established a service that runs until the encryption process is complete.^[157]

Wiarp creates a backdoor through which remote attackers can create a service.^[158]

Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.^[159][160]

Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.^[161]

Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.^[162][163]

ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.^[113]

ZLib creates Registry keys to allow itself to run as various services.^[164]

zwShell has established persistence by adding itself as a new service.^[165]

ZxShell can create a new service using the service parser function ProcessScCommand.^[166]

Use auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them.

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent an application from writing a signed vulnerable driver to the system.^[167] On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed service drivers.^[168]

Enforce registration and execution of only legitimately signed service drivers where possible.

Ensure that Driver Signature Enforcement is enabled to restrict unsigned drivers from being installed.

Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.