Techniques › T1569 › T1569.002
T1569.002 Service Execution
execution — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
43
Sigma rules tagged attack.t1569.002
1
KEV CVEs mapped here
<p>Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services. The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and Net.</p><p>PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API. Tools such as PsExec and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution.</p><p>Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2021-35394 | Realtek Jungle Software Development Kit (SDK) | secondary impact | Mapped | 2021-12-10 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0421 Detection Strategy for System Services Service Execution v1.0
AN1185 WindowsDetection focuses on abnormal service executions initiated via service control manager APIs, sc.exe, net.exe, or PsExec creating temporary services. Defenders observe process creation of services.exe spawning non-standard binaries, registry changes in service keys followed by rapid execution, and network connections originating from processes tied to transient services. Correlation across process lineage, registry activity, and service logs provides strong signals of malicious service execution.Tunable:
ServiceBinaryAllowlistParentProcessCorrelationWindowRemoteExecutionHosts
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1569.002
Author: Sagie Dulce, Dekel Paz
· 2022-01-01 · logsource: product=rpc_firewall category=application · 10018e73-06ec-46ec-8107-9172f1e04ff2
Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR
Author: Connor Martin, Nasreddine Bencherchali
· 2022-12-23 (modified 2023-06-22) · logsource: product=windows service=system · 1a31b18a-f00c-4061-9900-f735b96c99fc
Detects service installation of different remote access tools software. These software are often abused by threat actors to perform
Author: Frack113
· 2025-10-23 · logsource: product=windows category=registry_set · 1f1d8209-636e-4c6c-a137-781cca8b82f9
Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.
Author: Thomas Patzke
· 2017-06-12 (modified 2022-10-26) · logsource: product=windows category=file_event · 259e5a6a-b8d2-4c38-86e2-26c5e651361d
Detects default PsExec service filename which indicates PsExec service installation and execution
Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
· 2019-10-21 (modified 2023-03-05) · logsource: product=windows category=process_creation · 2a072a96-a086-49fa-bcb5-15cc5a619093
Detects the usage of the "net.exe" command to start a service using the "start" flag
Author: oscd.community, Natalia Shornikova
· 2020-10-06 (modified 2022-11-29) · logsource: product=windows service=security · 2a926e6a-4b81-4011-8a96-e36cc8c04302
Detects powershell script installed as a Service
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-08-25 · logsource: product=windows service=system · 31c51af6-e7aa-4da7-84d4-8f32cc580af2
Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-04 (modified 2023-09-20) · logsource: product=windows category=pipe_created · 41504465-5e3a-4a5b-a5b4-2a0baadd4463
Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack
Author: Thomas Patzke
· 2017-06-12 (modified 2023-08-04) · logsource: product=windows service=system · 42c575ea-e41e-41f1-b248-8093c3e82a28
Detects PsExec service installation and execution events
Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2017-03-05 (modified 2022-11-29) · logsource: product=windows service=system · 4976aa50-8f41-45c6-8b15-ab3fc10e79ed
Detects well-known credential dumping tools execution via service execution events
Author: oscd.community, Natalia Shornikova
· 2020-10-06 (modified 2023-08-17) · logsource: product=windows category=registry_set · 4a5f5a5e-ac01-474b-9b4e-d61298c9df1d
Detects that a powershell code is written to the registry as a service.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-01-24 (modified 2023-02-13) · logsource: product=windows category=process_creation · 4e2ed651-1906-4a59-a78a-18220fca1b22
Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity
Author: Omer Faruk Celik
· 2018-03-20 (modified 2023-11-09) · logsource: product=windows service=system · 52a85084-6989-40c3-8f32-091e12e13f09
Detects the use of smbexec.py tool by detecting a specific service installation
Author: Florian Roth (Nextron Systems), Wojciech Lesicki
· 2021-05-26 (modified 2022-11-27) · logsource: product=windows service=system · 5a105d34-05fc-401e-8553-272b45c1522d
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
Author: Bartlomiej Czyz, Relativity
· 2021-01-31 (modified 2023-02-28) · logsource: product=windows category=process_creation · 5bb68627-3198-40ca-b458-49f973db8752
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
Author: Wojciech Lesicki
· 2021-06-29 (modified 2024-03-25) · logsource: product=windows category=registry_set · 61a7697c-cb79-42a8-a2ff-5f0cdfae0130
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.
Author: Bartlomiej Czyz, Relativity
· 2021-01-21 (modified 2022-10-05) · logsource: product=windows service=security · 6fb63b40-e02a-403e-9ffd-3bcc1d749442
Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
· 2022-01-24 (modified 2023-02-13) · logsource: product=windows category=process_creation · 771d1eb5-9587-4568-95fb-9ec44153a012
Detects the use of NSudo tool for command execution
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-04 · logsource: product=windows category=file_event · 7eff1a7f-dd45-4c20-877a-f21e342a7611
Detects default RemCom service filename which indicates RemCom service installation and execution
Author: Florian Roth (Nextron Systems)
· 2022-01-24 (modified 2023-02-14) · logsource: product=windows category=process_creation · 93199800-b52a-4dec-b762-75212c196542
Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts
Author: Bhabesh Raj
· 2020-07-14 (modified 2022-12-25) · logsource: product=windows service=windefend · 97b9ce1e-c5ab-11ea-87d0-0242ac130003
Detects blocking of process creations originating from PSExec and WMI commands
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-07 · logsource: product=windows service=system · 9e36ed87-4986-482e-8e3b-5c23ffff11bf
Detects RemCom service installation and execution events
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-07 · logsource: product=windows service=system · a27e5fa9-c35e-4e3d-b7e0-1ce2af66ad12
Detects CSExec service installation and execution events
Author: oscd.community, Natalia Shornikova
· 2020-10-06 (modified 2022-12-25) · logsource: product=windows service=system · a2e5019d-a658-4c6a-92bf-7197b54e2cae
Detects powershell script installed as a Service
Author: Florian Roth (Nextron Systems)
· 2022-04-13 (modified 2023-02-03) · logsource: product=windows category=process_creation · a7cd7306-df8b-4398-b711-6f3e4935cf16
Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)
Author: Florian Roth (Nextron Systems)
· 2020-07-15 (modified 2022-07-12) · logsource: product=windows category=process_creation · b5281f31-f9cc-4d0d-95d0-45b91c45b487
Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process
Author: @neu5ron, SOC Prime
· 2020-03-19 (modified 2021-11-27) · logsource: product=zeek service=dce_rpc · b640c0b8-87f8-4daa-aef8-95a24261dd1d
Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE
Author: Saw Winn Naung, Azure-Sentinel, @neu5ron
· 2021-08-19 (modified 2022-07-07) · logsource: product=zeek service=dns · bf74135c-18e8-4a72-a926-0e4f47888c19
Identifies clients that may be performing DNS lookups associated with common currency mining pools.
Author: Florian Roth (Nextron Systems)
· 2022-08-20 (modified 2023-02-13) · logsource: product=windows category=process_creation · c484e533-ee16-4a93-b6ac-f0ea4868b2f1
Detects the use of SharpUp, a tool for local privilege escalation
Author: Florian Roth (Nextron Systems)
· 2021-05-27 (modified 2022-12-25) · logsource: product=windows service=system · c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9
Detects a ProcessHacker tool that elevated privileges to a very high level
Author: Connor Martin, Nasreddine Bencherchali (Nextron Systems)
· 2022-12-23 (modified 2024-12-07) · logsource: product=windows service=security · c8b00925-926c-47e3-beea-298fd563728e
Detects service installation of different remote access tools software. These software are often abused by threat actors to perform
Author: Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)
· 2017-03-27 (modified 2022-10-09) · logsource: product=windows service=security · cb062102-587e-4414-8efa-dbe3c7bf19c6
Detects the installation of a service named "javamtsup" on the system.
The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.
Author: Florian Roth (Nextron Systems)
· 2022-08-22 (modified 2023-02-21) · logsource: product=windows category=process_creation · d08a2711-ee8b-4323-bdec-b7d85e892b31
Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative
Author: Florian Roth (Nextron Systems)
· 2022-03-21 (modified 2023-08-07) · logsource: product=windows service=system · d26ce60c-2151-403c-9a42-49420d87b5e4
Detects installation or execution of services
Author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2023-08-07 (modified 2023-11-30) · logsource: product=windows category=pipe_created · d36f87ea-c403-44d2-aa79-1a0ac7c24456
Detects default RemCom pipe creation
Author: Florian Roth (Nextron Systems), Wojciech Lesicki
· 2021-05-26 (modified 2022-11-27) · logsource: product=windows service=security · d7a95147-145f-4678-b85d-d1ff4a3bb3f6
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-01-24 (modified 2023-02-13) · logsource: product=windows category=process_creation · d9047477-0359-48c9-b8c7-792cedcdc9c4
Detects the use of NirCmd tool for command execution as SYSTEM user
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-26 · logsource: product=windows service=system · de7ce410-b3fb-4e8a-b38c-3b999e2c3420
Detects PAExec service installation
Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2017-03-05 (modified 2022-11-29) · logsource: product=windows service=security · f0d1feba-4344-4ca9-8121-a6c97bd6df52
Detects well-known credential dumping tools execution via service execution events
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-04 · logsource: product=windows category=file_event · f0e2b768-5220-47dd-b891-d57b96fc0ec1
Detects default CSExec service filename which indicates CSExec service installation and execution
Author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2023-08-07 (modified 2023-11-30) · logsource: product=windows category=pipe_created · f318b911-ea88-43f4-9281-0de23ede628e
Detects default CSExec pipe creation
Author: Thomas Patzke
· 2017-06-12 (modified 2022-10-09) · logsource: product=windows category=pipe_created · f3f3a972-f982-40ad-b63c-bca6afdfad7c
Detects PsExec service default pipe creation
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-26 · logsource: product=windows category=pipe_created · f6451de4-df0a-41fa-8d72-b39f54a08db5
Detects PAExec default named pipe
Rules tagged at the parent level (attack.t1569) 4
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w, Tim Shelton
· 2021-06-30 (modified 2022-11-15) · logsource: product=windows service=printservice-admin · 4e64668a-4da1-49f5-a8df-9e2d5b866718
Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675
Author: omkar72
· 2020-10-30 (modified 2023-02-28) · logsource: product=windows category=process_creation · 730fc21b-eaff-474b-ad23-90fd265d4988
Detects user accept agreement execution in psexec commandline
Author: INIT_6
· 2021-07-02 (modified 2022-10-05) · logsource: product=windows service=security · 8fe1c584-ee61-444b-be21-e9054b229694
Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527
Author: Florian Roth (Nextron Systems)
· 2021-07-01 (modified 2022-10-09) · logsource: product=windows service=printservice-operational · f34d942d-c8c4-4f1f-b196-22471aecf10a
Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675