Full Report
Actionable guide to hunting for the Windows Services abuse by using Group-IB MXDR.
Analysis Summary
# Tool/Technique: Windows Service Abuse (Creation and Modification)
## Overview
This technique involves the abuse of the Windows Service Control Manager (SCM) to establish persistence, escalate privileges, or execute malicious code. Threat actors create new services or modify existing ones to ensure their payloads execute automatically upon system startup or under high-privilege accounts (e.g., SYSTEM).
## Technical Details
- **Type**: Technique
- **Platform**: Windows
- **Capabilities**: Persistence, Privilege Escalation, Defense Evasion.
- **First Seen**: Long-standing technique inherent to the Windows operating system architecture.
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- **[T1543 - Create or Modify System Process]**
- **[T1543.003 - Windows Service]**
- **[TA0004 - Privilege Escalation]**
- **[T1543.003 - Windows Service]**
## Functionality
### Core Capabilities
- **Service Creation**: Using system utilities like `sc.exe` to register a new service that points to a malicious executable or script.
- **Registry Manipulation**: Direct modification of the Windows Registry keys (specifically under `HKLM\SYSTEM\CurrentControlSet\Services`) to define or alter service parameters without using high-level APIs.
### Advanced Features
- **API-based Creation**: Utilizing the Windows API (e.g., `CreateServiceA/W`) directly through custom malware or backdoors to bypass command-line logging.
- **Service DLL Loading**: Configuring a service to run via `svchost.exe` by specifying a `ServiceDll` in the registry, allowing the malware to reside within a legitimate process container.
## Indicators of Compromise
- **File Names**: `sc.exe`, `reg.exe`, `regedit.exe` (when used for service manipulation).
- **Registry Keys**:
- `HKLM\SYSTEM\CurrentControlSet\Services\[ServiceName]\ImagePath`
- `HKLM\SYSTEM\CurrentControlSet\Services\[ServiceName]\Parameters\ServiceDll`
- **Behavioral Indicators**:
- Execution of `sc.exe` with the `create` or `config` arguments.
- Unexpected processes running with `SYSTEM` privileges.
- Modification of the `Services` registry hive by non-standard system processes.
## Associated Threat Actors
- Widely used by virtually all sophisticated threat groups (APTs) and ransomware operators, including but not limited to:
- **APT28**
- **Lazarus Group**
- **Wizard Spider**
## Detection Methods
- **Behavioral Detection**:
- Monitoring for process creation events where `sc.exe` is a child process with "create" in the command line.
- *Query Example*: `event_type: "Process creation" AND Payload.ImageFileName: "*\\sc.exe" AND Payload.Commandline: "* create *"`
- **Registry Monitoring**:
- Hunting for creation or modification of values named `ImagePath` or `ServiceDll` within the `\services\` registry path.
- *Query Example*: `event_type: "Registry key value creation or modification" AND Payload.KeyName: "*\\services\\*" AND Payload.Value: ["ImagePath", "ServiceDll"]`
## Mitigation Strategies
- **Prevention Measures**:
- Implement the Principle of Least Privilege (PoLP) to ensure users do not have administrative rights to create services.
- Use Application Whitelisting (e.g., AppLocker or Windows Defender Application Control) to prevent unauthorized executables from being registered as services.
- **Hardening Recommendations**:
- Audit and restrict access to the `HKLM\SYSTEM\CurrentControlSet\Services` registry key.
- Enable advanced auditing for "Plug and Play" and "Other Object Access Events" to track service installations.
## Related Tools/Techniques
- **PsExec**: Often used by attackers to create services on remote systems.
- **NSSM (Non-Sucking Service Manager)**: A legitimate tool often abused by attackers to wrap scripts as services.
- **Scheduled Tasks (T1053.005)**: A common alternative for achieving similar persistence.