CAPECattack pattern
CAPEC-551 Modify Existing Service
- Abstraction
- Detailed
- Status
- Draft
- CAPEC version
- 3.9
Description
When an operating system starts, it also starts programs called services or daemons. Modifying existing services may break existing services or may enable services that are disabled/not commonly used.
Mitigations
• Limit privileges of user accounts so service changes can only be performed by authorized administrators. Also monitor any service changes that may occur inadvertently.
Related
Att&ck technique · MITRE ATT&CK (1)
- T1543 Create or Modify System Process technique
Child of · CAPEC (1)
- CAPEC-542 Targeted Malware attack pattern