MITRE ATT&CKsub-technique

T1569.002 Service Execution

Published 2020-03-10 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Windows
Version
1.3
Created
2020-03-10

Description

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services. The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API. Tools such as PsExec and sc.exe can accept remote servers as arguments and may be used to conduct remote execution. Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1569 System Services technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1040 Behavior Prevention on Endpoint mitigation
  • M1022 Restrict File and Directory Permissions mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (74)

  • S9051 The Gentlemen Ransomware software (malware)
  • S9050 Vidar software (malware)
  • C0061 Operation Digital Eye campaign
  • S1247 Embargo software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1051 Medusa Group group
  • G1047 Velvet Ant group
  • S1202 LockBit 3.0 software (malware)
  • S1181 BlackByte 2.0 Ransomware software (malware)
  • G1043 BlackByte group
  • C0040 APT41 DUST campaign
  • G1036 Moonstone Sleet group
  • G1032 INC Ransom group
  • S1132 IPsec Helper software (malware)
  • S1134 DEADWOOD software (malware)
  • S1111 DarkGate software (malware)
  • S1063 Brute Ratel C4 software (tool)
  • S1060 Mafalda software (malware)
  • C0014 Operation Wocao campaign
  • C0006 Operation Honeybee campaign
  • S0697 HermeticWiper software (malware)
  • S0698 HermeticWizard software (malware)
  • S0689 WhisperGate software (malware)
  • S0668 TinyTurla software (malware)
  • S0663 SysUpdate software (malware)
  • S0664 Pandora software (malware)
  • S0660 Clambling software (malware)
  • S0612 WastedLocker software (malware)
  • S0583 Pysa software (malware)
  • S0606 Bad Rabbit software (malware)
Show all 74 ›

Referenced by Compliance · mitigates (14)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References