Situational AwarenessTTPCAR-2014-02-001

Service Binary Modifications

Hypothesis and description

Adversaries may modify the binary file for an existing service to achieve Persistence while potentially evading defenses. If a newly created or modified runs as a service, it may indicate APT activity. However, services are frequently installed by legitimate software. A well-tuned baseline is essential to differentiating between benign and malicious service modifications.

### Output Description

The Service Name and approximate time in which changes occurred on each host

Platforms: Windows
Domain: Host
Subtypes: Registry File Process
Submitted: 2014-02-14
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1543 Create or Modify System ProcessT1543.003	Persistence, Privilege Escalation	Moderate
T1574 Hijack Execution FlowT1574.010	Persistence, Privilege Escalation	Moderate
T1569 System ServicesT1569.002	Execution	Moderate

3 techniques, 6 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

D3FEND techniques MITRE maps to this analytic

D3-SBV Service Binary Verification

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

Look for events where a file was created and then later run as a service. In these cases, a new service has been created or the binary has been modified. Many programs, such as msiexec.exe, do these behaviors legitimately and can be used to help validate legitimate service creations/modifications.

legitimate_installers = ["C:\windows\system32\msiexec.exe", "C:\windows\syswow64\msiexec.exe", ...]

file_change = search File:Create,Modify
process = search Process:Create
service_process = filter processes where (parent_exe == "services.exe")
modified_service = join (search, filter) where (
 file_change.time < service_process.time and
 file_change.file_path == service_process.image_path
)

modified_service = filter modified_service where (modified_service.file_change.image_path not in legitimate_installers)
output modified_service

Across MITRE's defensive frameworks

Linked through the 3 ATT&CK techniques above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

15 more in the full list

View CAR-2014-02-001 on car.mitre.org