Techniques › T1574.010 › AN1211
AN1211 Analytic 1211
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Modification or replacement of service executables due to weak file or directory permissions. Defender observes file writes to service binary paths, unexpected modifications of executables associated with registered services, and subsequent service execution of attacker-supplied binaries under elevated permissions.</p>
- Detects
- T1574.010 Services File Permissions Weakness
- Part of
- DET0436 Detection Strategy for Hijack Execution Flow through Services File Permissions Weakness.
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=15 | DC0059 File Metadata |
| WinEventLog:System | EventCode=7045 | DC0060 Service Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
MonitoredServices | List of critical services and their expected executable paths for integrity checking. |
HashBaseline | Baseline hashes of legitimate service executables for tamper detection. |
TimeWindow | Correlation interval between file modification of service executables and service execution. |
PrivilegedAccounts | Accounts allowed to legitimately modify service executables. |