Services Registry Permissions Weakness
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under <code>HKLM\SYSTEM\CurrentControlSet\Services</code>. The information stored under a service's Registry keys can be m...
BY SOURCE
PROCEDURES (10)
Auto-extracted: 3 detections for process creation monitoring
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for aws
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for registry