kevmap

TechniquesT1574.011 › AN1195

AN1195 Analytic 1195

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Unauthorized modification of service-related registry keys such as ImagePath, FailureCommand, ServiceDll, or Performance/Parameters keys. Defender correlates registry modifications, anomalous service metadata changes, and subsequent service process executions that deviate from baseline configurations.</p>
Detects
T1574.011 Services Registry Permissions Weakness
Part of
DET0427 Detection Strategy for Hijack Execution Flow through Service Registry Premission Weakness.

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
WinEventLog:SecurityEventCode=4657DC0063 Windows Registry Key Modification
WinEventLog:SystemEventCode=7040DC0065 Service Modification
WinEventLog:SysmonEventCode=1DC0032 Process Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
MonitoredServiceKeysRegistry subkeys for critical services (ImagePath, ServiceDll, FailureCommand, Parameters).
BaselineServiceConfigKnown good service registry configurations and paths for comparison.
TimeWindowCorrelation interval between registry/service modifications and service execution.
PrivilegedAccountsAccounts permitted to modify service configurations.