Description
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API.
Adversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: .sys) to disk, the payload can be loaded and registered via Native API functions such as CreateServiceW() (or manually via functions such as ZwLoadDriver() and ZwSetValueKey()), by creating the required service Registry values (i.e. Modify Registry), or by using command-line utilities such as PnPUtil.exe.(Citation: Symantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Unit42 AcidBox June 2020) Adversaries may leverage these drivers as Rootkits to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of Exploitation for Privilege Escalation.(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020)
Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through Service Execution.
To make detection analysis more challenging, malicious services may also incorporate Masquerade Task or Service (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create ‘hidden’ services (i.e., Hide Artifacts), for example by using the sc sdset command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as Get-Service, sc query, and services.exe.(Citation: SANS 1)(Citation: SANS 2)
Platforms
Mitigations (5)
Operating System ConfigurationM1028
Ensure that Driver Signature Enforcement is enabled to restrict unsigned drivers from being installed.
Code SigningM1045
Enforce registration and execution of only legitimately signed service drivers where possible.
Behavior Prevention on EndpointM1040
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent an application from writing a signed vulnerable driver to the system.(Citation: Malicious Driver Reporting Center) On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed service drivers.(Citation: Microsoft driver block rules)
User Account ManagementM1018
Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.
AuditM1047
Use auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them.
Threat Groups (26)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has installed a new Windows service to establish persistence.(Citation: CISA AA20-239A BeagleBoyz Augus... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) modified multiple services on victim machines to enable encryption operations.(Citation: Symantec B... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has a tool that creates a new service for persistence.(Citation: FireEye Operation Double Tap) |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has created new services for persistence.(Citation: Securelist Kimsuky Sept 2013)(Citation: CISA AA20... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) modified legitimate Windows services to install malware backdoors.(Citation: FireEye APT41 Aug 2019)(Ci... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) modified Windows Services to ensure PowerShell scripts were loaded on the system. [APT32](https://attac... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has used malware that adds cryptocurrency miners as a service.(Citation: ATT TeamTNT Chimaera Septemb... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) created new Windows services and added them to the startup directories for persistence.(Citation: FireEy... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used a compromised Domain Controller to create a service on a remote host.(Citation: Symantec Cram... |
| G0008 | Carbanak | [Carbanak](https://attack.mitre.org/groups/G0008) malware installs itself as a service to provide persistence and SYSTEM privileges.(Citation: Kaspers... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) has installed a service pointing to a malicious DLL dropped to disk.(Citation: PWC KeyBoys Feb... |
| G0143 | Aquatic Panda | [Aquatic Panda](https://attack.mitre.org/groups/G0143) created new Windows services for persistence that masqueraded as legitimate Windows services vi... |
| G0004 | Ke3chang | [Ke3chang](https://attack.mitre.org/groups/G0004) backdoor RoyalDNS established persistence through adding a service called <code>Nwsapagent</code>.(C... |
| G0108 | Blue Mockingbird | [Blue Mockingbird](https://attack.mitre.org/groups/G0108) has made their XMRIG payloads persistent as a Windows Service.(Citation: RedCanary Mockingbi... |
| G0105 | DarkVishnya | [DarkVishnya](https://attack.mitre.org/groups/G0105) created new services for shellcode loaders distribution.(Citation: Securelist DarkVishnya Dec 201... |
| G0030 | Lotus Blossom | [Lotus Blossom](https://attack.mitre.org/groups/G0030) has configured tools such as [Sagerunex](https://attack.mitre.org/software/S1210) to run as Win... |
| G1021 | Cinnamon Tempest | [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) has created system services to establish persistence for deployed tooling.(Citation: Sygnia ... |
| G1051 | Medusa Group | [Medusa Group](https://attack.mitre.org/groups/G1051) has used vulnerable or signed drivers to modify security solutions on victim devices.(Citation: ... |
| G1030 | Agrius | [Agrius](https://attack.mitre.org/groups/G1030) has deployed [IPsec Helper](https://attack.mitre.org/software/S1132) malware post-exploitation and reg... |
| G0032 | Lazarus Group | Several [Lazarus Group](https://attack.mitre.org/groups/G0032) malware families install themselves as new services.(Citation: Novetta Blockbuster)(Cit... |
Associated Software (109)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) establishes persistence by creating an autostart service that allows it to run whenever the machin... |
| S1100 | Ninja | Malware | [Ninja](https://attack.mitre.org/software/S1100) can create the services `httpsvc` and `w3esvc` for persistence .(Citation: Kaspersky ToddyCat June 20... |
| S0206 | Wiarp | Malware | [Wiarp](https://attack.mitre.org/software/S0206) creates a backdoor through which remote attackers can create a service.(Citation: Symantec Wiarp May ... |
| S0343 | Exaramel for Windows | Malware | The [Exaramel for Windows](https://attack.mitre.org/software/S0343) dropper creates and starts a Windows service named wsmprovav with the description ... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) uses a driver registered as a boot start service as the main load-point.(Citation: Nicolas Falliere... |
| S0164 | TDTESS | Malware | If running as administrator, [TDTESS](https://attack.mitre.org/software/S0164) installs itself as a new service named bmwappushservice to establish pe... |
| S0082 | Emissary | Malware | [Emissary](https://attack.mitre.org/software/S0082) is capable of configuring itself as a service.(Citation: Emissary Trojan Feb 2016) |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) has registered itself as a system service in the Registry for automatic execution at system startup.... |
| S0665 | ThreatNeedle | Malware | [ThreatNeedle](https://attack.mitre.org/software/S0665) can run in memory and register its payload as a Windows service.(Citation: Kaspersky ThreatNee... |
| S0086 | ZLib | Malware | [ZLib](https://attack.mitre.org/software/S0086) creates Registry keys to allow itself to run as various services.(Citation: Cylance Dust Storm) |
| S0239 | Bankshot | Malware | [Bankshot](https://attack.mitre.org/software/S0239) can terminate a specific process by its process id.(Citation: McAfee Bankshot)(Citation: US-CERT B... |
| S0491 | StrongPity | Malware | [StrongPity](https://attack.mitre.org/software/S0491) has created new services and modified existing services for persistence.(Citation: Talos Prometh... |
| S0630 | Nebulae | Malware | [Nebulae](https://attack.mitre.org/software/S0630) can create a service to establish persistence.(Citation: Bitdefender Naikon April 2021) |
| S0347 | AuditCred | Malware | [AuditCred](https://attack.mitre.org/software/S0347) is installed as a new service on the system.(Citation: TrendMicro Lazarus Nov 2018) |
| S1239 | TONESHELL | Malware | [TONESHELL](https://attack.mitre.org/software/S1239) has created a malicious service DISMsrv to maintain persistence.(Citation: Palo Alto Unit42 STATE... |
| S1211 | Hannotog | Malware | [Hannotog](https://attack.mitre.org/software/S1211) creates a new service for persistence.(Citation: Symantec Bilbug 2022) |
| S1244 | Medusa Ransomware | Malware | [Medusa Ransomware](https://attack.mitre.org/software/S1244) has created a new PowerShell process using the `CreateProcessA` API.(Citation: Security S... |
| S0629 | RainyDay | Malware | [RainyDay](https://attack.mitre.org/software/S0629) can use services to establish persistence.(Citation: Bitdefender Naikon April 2021) |
| S1226 | BOOKWORM | Malware | [BOOKWORM](https://attack.mitre.org/software/S1226) has created a service named `Microsoft Windows DeviceSync Service` at `HKLM\SYSTEM\CurrentControlS... |
| S0050 | CosmicDuke | Malware | [CosmicDuke](https://attack.mitre.org/software/S0050) uses Windows services typically named "javamtsup" for persistence.(Citation: F-Secure Cosmicduke... |
References
- Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding to help with intrusion detection. Retrieved August 7, 2018.
- Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
- Joshua Wright. (2020, October 13). Retrieved March 22, 2024.
- Joshua Wright. (2020, October 14). Retrieved March 22, 2024.
- Microsoft. (n.d.). Services. Retrieved June 7, 2016.
- Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service was installed in the system. Retrieved August 7, 2018.
- Nicolas Falliere, Liam O. Murchu, Eric Chien. (2011, February). W32.Stuxnet Dossier. Retrieved December 7, 2020.
- Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations. Retrieved March 16, 2021.
- Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.
- Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022.
Frequently Asked Questions
What is T1543.003 (Windows Service)?
T1543.003 is a MITRE ATT&CK technique named 'Windows Service'. It belongs to the Persistence, Privilege Escalation tactic(s). Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perfor...
How can T1543.003 be detected?
Detection of T1543.003 (Windows Service) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1543.003?
There are 5 documented mitigations for T1543.003. Key mitigations include: Operating System Configuration, Code Signing, Behavior Prevention on Endpoint, User Account Management, Audit.
Which threat groups use T1543.003?
Known threat groups using T1543.003 include: APT38, BlackByte, APT3, Kimsuky, APT41, APT32, TeamTNT, FIN7.