DetailedCAPEC-550
CAPEC-550: Install New Service
Description
When an operating system starts, it also starts programs called services or daemons. Adversaries may install a new service which will be executed at startup (on a Windows system, by modifying the registry). The service name may be disguised by using a name from a related operating system or benign software. Services are usually run with elevated privileges.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Inject Unexpected Items
Mitigations
- Limit privileges of user accounts so new service creation can only be performed by authorized administrators.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SFASystem File Analysis1 shared
- D3-SCPSystem Configuration Permissions1 shared
- D3-RDRestore Database1 shared
- D3-DIData Inventory1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
- D3-FEFile Encryption1 shared
- D3-FEVFile Eviction1 shared
- D3-FIMFile Integrity Monitoring1 shared
- D3-LFPLocal File Permissions1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-09-005Service Outlier Executables1 shared
- CAR-2014-05-002Services launching Cmd1 shared
- CAR-2014-03-005Remotely Launched Executables via Services1 shared
- CAR-2014-02-001Service Binary Modifications1 shared
- CAR-2013-01-002Autorun Differences1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared