CAPEC-478: Modification of Windows Service Configuration
Description
An adversary exploits a weakness in access control to modify the execution parameters of a Windows service. The goal of this attack is to execute a malicious binary in place of an existing service.
- Likelihood of attack
- Low
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate System Resources
Prerequisites
- The adversary must have the capability to write to the Windows Registry on the targeted system.
Consequences
- Integrity
Execute Unauthorized Commands
By altering specific configuration settings for the service, the adversary could run arbitrary code to be executed.
Mitigations
- Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SFASystem File Analysis2 shared
- D3-CFContent Filtering2 shared
- D3-CMContent Modification2 shared
- D3-DFDecoy File2 shared
- D3-FAFile Analysis2 shared
- D3-FEFile Encryption2 shared
- D3-FEVFile Eviction2 shared
- D3-FIMFile Integrity Monitoring2 shared
- D3-LFPLocal File Permissions2 shared
- D3-RFAMRemote File Access Mediation2 shared
- D3-RFRestore File2 shared
- D3-CQContent Quarantine2 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2014-02-001Service Binary Modifications2 shared
- CAR-2013-01-002Autorun Differences2 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands2 shared
- CAR-2013-09-005Service Outlier Executables1 shared
- CAR-2014-05-002Services launching Cmd1 shared
- CAR-2014-07-001Service Search Path Interception1 shared
- CAR-2014-03-005Remotely Launched Executables via Services1 shared
- CAR-2021-11-001Registry Edit with Creation of SafeDllSearchMode Key Set to 01 shared
- CAR-2013-03-001Reg.exe called from Command Shell1 shared
- CAR-2020-05-003Rare LolBAS Command Lines1 shared