Windows Service
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Adversaries may install a new service or modify an existing service to execute ...
BY SOURCE
PROCEDURES (44)
Auto-extracted: 7 detections for driver
Auto-extracted: 4 detections for remote
Auto-extracted: 4 detections for suspicious
Auto-extracted: 4 detections for persist
Auto-extracted: 3 detections for service
Auto-extracted: 3 detections for registry
Auto-extracted: 3 detections for powershell
Auto-extracted: 3 detections for suspicious
Auto-extracted: 3 detections for remote
Auto-extracted: 3 detections for lateral
Auto-extracted: 3 detections for persist
Auto-extracted: 2 detections for beacon
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for kernel
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for lateral
Auto-extracted: 2 detections for kernel
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for driver
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for driver
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for general monitoring
Auto-extracted: 1 detections for file monitoring
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for beacon
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for powershell