Sub-technique of T1574 Hijack Execution Flow.View on attack.mitre.org
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, PowerShell, or Reg. Access to Registry keys is controlled through access control lists and user permissions.
If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).
Adversaries may also alter other Registry keys in the service’s Registry tree. For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.
The Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL. If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service’s Registry tree to point to a malicious DLL.
Adversaries may also add the Parameters key, which can reference malicious drivers file paths. This technique has been identified to be a method of abuse by configuring DLL file paths within the Parameters key of a given services registry configuration. By placing and configuring the Parameters key to reference a malicious DLL, adversaries can ensure that their code is loaded persistently whenever the associated service or library is invoked.
For example, the registry path HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters contains the AutodiaDLL value, which specifies the DLL to be loaded for autodial funcitionality. An adversary could set the AutodiaDLL to point to a hijacked or malicious DLL:
"AutodialDLL"="c:\temp\foo.dll"
This ensures persistence, as it causes the DLL (in this case, foo.dll) to be loaded each time the Winsock 2 library is invoked.
Rules on DetectionCode tagged with T1574.011.
| Rule | Level | Log source |
|---|---|---|
| Abuse of Service Permissions to Hide Services Via Set-Service | high | windows / process_creation |
| Abuse of Service Permissions to Hide Services Via Set-Service - PS | high | windows / ps_script |
| Possible Privilege Escalation via Weak Service Permissions | high | windows / process_creation |
| Potential Privilege Escalation via Service Permissions Weakness | high | windows / process_creation |
| Service DACL Abuse To Hide Services Via Sc.EXE | high | windows / process_creation |
| Suspicious Service DACL Modification Via Set-Service Cmdlet - PS | high | windows / ps_script |
| Changing Existing Service ImagePath Value Via Reg.EXE | medium | windows / process_creation |
| Potential Persistence Attempt Via Existing Service Tampering | medium | windows / process_creation |
| Service Registry Permissions Weakness Check | medium | windows / ps_script |
| Service Security Descriptor Tampering Via Sc.EXE | medium | windows / process_creation |
| Service Registry Key Read Access Request | low | windows / NULL |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Reg exe Manipulating Windows Services Registry Keys | TTP | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
| Windows Service Creation Using Registry Entry | Anomaly | NULL | Sysmon EventID 13 |
None recorded.
None recorded.
| Used by | Procedure example |
|---|---|
| CampaignOperation Honeybee | During Operation Honeybee, the threat actors used a batch file that modified the COMSysApp service to load a malicious ipnet.dll payload and to load a DLL into the `svchost.exe` process. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
