Full Report
Actionable guide to hunting for the Windows Services abuse by using Group-IB MXDR.
Analysis Summary
# Tool/Technique: Windows Services Abuse
## Overview
Windows Services are frequently targeted by attackers to achieve persistence, escalate privileges, or execute malicious code within a high-integrity environment. Because services are a standard component of the Windows operating system and often run with SYSTEM privileges, they provide a stealthy mechanism for maintaining a presence on a compromised host. Attackers may create new services, modify existing ones, or load malicious DLLs into legitimate service hosting processes like `svchost.exe`.
## Technical Details
- **Type:** Technique
- **Platform:** Windows
- **Capabilities:** Persistence, Privilege Escalation, Stealthy Execution, Lateral Movement.
- **First Seen:** Continuous (Core Windows functionality leveraged since early NT versions).
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- **[T1543.003 - Create or Modify System Process: Windows Service]**
- **[TA0004 - Privilege Escalation]**
- **[T1543.003 - Create or Modify System Process: Windows Service]**
- **[TA0002 - Execution]**
- **[T1569.002 - System Services: Service Execution]**
- **[TA0005 - Defense Evasion]**
- **[T1055.001 - Process Injection: Dynamic-link Library Injection]**
## Functionality
### Core Capabilities
- **Service Creation:** Attackers use tools (like `sc.exe`) or APIs to register a new malicious binary as a service to ensure it starts automatically upon system boot.
- **Service Modification:** Altering the binary path (`binPath`) of an existing, legitimate service to point to a malicious executable.
- **Service Start/Stop:** Programmatically controlling services to disable security software or trigger malicious payloads.
### Advanced Features
- **Shared Process Loading (svchost.exe):** Loading a malicious `.dll` into a `svchost.exe` process. This is harder to detect than a standalone executable because `svchost.exe` is a ubiquitous system process.
- **Signature Evasion:** Using unsigned or self-signed DLLs within service hosts to blend in with legitimate system activity.
## Indicators of Compromise
- **File Names:** `svchost.exe` (as a parent process for suspicious DLLs), `sc.exe`.
- **Registry Keys:** `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[Service Name]`
- **Behavioral Indicators:**
- `svchost.exe` loading unsigned DLLs.
- Unexpected creation of new services by non-admin users.
- Services pointing to files in temporary directories (e.g., `C:\Users\...\AppData\Local\Temp`) or non-standard paths.
- Modification of the `ImagePath` or `ServiceDll` registry values for existing services.
## Associated Threat Actors
- Widely used by virtually all sophisticated threat groups (APTs) and Ransomware operators, including but not limited to:
- **Lazarus Group**
- **APT28 (Fancy Bear)**
- **Wizard Spider** (Ryuk/Conti)
## Detection Methods
- **Behavioral Detection:** Monitoring for `event_type: "Loading executable code in the process"` where the parent process is `svchost.exe` and the loaded image is an unsigned `.dll`.
- **Query-Based Hunting:**
- `event_type: "Loading executable code in the process" AND Payload.ImageFileName: "*.dll" AND Header.ImageFileName: "*\\svchost.exe"`
- **Anomaly Detection:** Identifying "outliers" in service DLL loading across a fleet of machines. Legitimate services typically load a consistent set of signed Microsoft DLLs.
## Mitigation Strategies
- **Prevention Measures:** Implement Least Privilege principles to ensure users cannot create or modify system services.
- **Hardening:**
- Enable **Code Integrity Guards** to prevent unsigned DLLs from being loaded into sensitive processes.
- Monitor and audit changes to the `Services` registry hive.
- Use **Attack Surface Reduction (ASR)** rules to block process creations from PsExec or WMI that attempt to create services.
## Related Tools/Techniques
- **PsExec:** Often used to create services remotely for lateral movement.
- **SC.exe:** The standard Windows command-line utility for service manipulation.
- **Reflective DLL Injection:** A method used to load DLLs into services without them ever touching the disk.