CAPECattack pattern
CAPEC-550 Install New Service
- Abstraction
- Detailed
- Status
- Draft
- CAPEC version
- 3.9
Description
When an operating system starts, it also starts programs called services or daemons. Adversaries may install a new service which will be executed at startup (on a Windows system, by modifying the registry). The service name may be disguised by using a name from a related operating system or benign software. Services are usually run with elevated privileges.
Mitigations
• Limit privileges of user accounts so new service creation can only be performed by authorized administrators.
Related
Att&ck technique · MITRE ATT&CK (1)
- T1543 Create or Modify System Process technique
Child of · CAPEC (1)
- CAPEC-542 Targeted Malware attack pattern
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
Referenced by CWE · attack pattern (1)
- CWE-284 Improper Access Control weakness