MITRE ATT&CK™ Analysis - T1543.003 Windows Service

New Service Overview

A service is an application which runs in the background without a user interface and are often used for core operating system functions. Because of this traditionally GUI based applications and standard executables can’t be natively run as a service without using some kind of wrapper.

New Service Analysis

Lab Example

RED TEAM: ATTACK

A service has been created using the Windows NT Resource Kit (in particular INSTSRV.EXE to install the service and SRVANY.EXE to act as a wrapper and run an arbitrary executable as a service).

More information:

• How To Create a User-Defined Service

  “C:\Program Files\Windows Resource Kits\Tools\INSTSRV.EXE” CyberRaijuWasHere “C:\Program Files\Windows Resource Kits\Tools\SRVANY.EXE”

The service being configured, including how it looks once registry keys are modified and the service is executed is shown below.

BLUE TEAM: DEFEND

Event ID 7045 shows us the installation of this service.

The end result is whenever the computer boots, the service is run which silently executes the calculator executable on this host with system level privileges.