To make detection analysis more challenging, malicious services may also incorporate Masquerade Task or Service (ex: using a service and/or payload name related to a legitimate OS or benign software component).Īnchor can establish persistence by creating a service. Adversaries may also directly start services through Service Execution. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of Exploitation for Privilege Escalation. Adversaries may leverage these drivers as Rootkits to hide the presence of malicious activity on a system. Modify Registry), or by using command-line utilities such as PnPUtil.exe. sys) to disk, the payload can be loaded and registered via Native API functions such as CreateServiceW() (or manually via functions such as ZwLoadDriver() and ZwSetValueKey()), by creating the required service Registry values (i.e. ![]() ![]() For example, after dropping a driver file (ex. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API.Īdversaries may also use services to install and execute malicious drivers. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.Īdversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. When Windows boots up, it starts programs or applications called services that perform background system functions. ![]() Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |