Service Execution
Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039). [PsExec](https://attack.mitre.org/software/S0029) can also b...
BY SOURCE
PROCEDURES (29)
Auto-extracted: 8 detections for service
Auto-extracted: 6 detections for process creation monitoring
Auto-extracted: 5 detections for lateral
Auto-extracted: 3 detections for registry
Auto-extracted: 3 detections for persist
Auto-extracted: 3 detections for powershell
Auto-extracted: 3 detections for service
Auto-extracted: 3 detections for general monitoring
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for ransomware
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for beacon
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for suspicious
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for cloud monitoring
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for beacon
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for event log