CAPEC-478 Modification of Windows Service Configuration

An adversary exploits a weakness in access control to modify the execution parameters of a Windows service. The goal of this attack is to execute a malicious binary in place of an existing service.

1. [Explore] [Determine target system] The adversary must first determine the system they wish to modify the registry of. This needs to be a windows machine as this attack only works on the windows registry. 2. [Experiment] [Gain access to the system] The adversary needs to gain access to the system in some way so that they can modify the windows registry. 3. [Exploit] [Modify windows registry] The adversary will modify the windows registry by changing the configuration settings for a service. Specifically, the adversary will change the path settings to define a path to a malicious binary to be executed.

• The adversary must have the capability to write to the Windows Registry on the targeted system.

• Integrity: Execute Unauthorized Commands

• Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.