t1543-003-windows-service

name	T1543.003_windows-service
description	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1543.003","persistence","privilege-escalation","windows","sub-technique"]
technique_id	T1543.003
tactic	persistence
all_tactics	["persistence","privilege-escalation"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1543/003
tech_stack	["windows"]
cwe_ids	["CWE-276"]
chains_with	["T1543","T1543.001","T1543.002","T1543.004","T1543.005"]
prerequisites	["T1543"]
severity_boost	{"T1543":"Chain with T1543 for deeper attack path","T1543.001":"Chain with T1543.001 for deeper attack path","T1543.002":"Chain with T1543.002 for deeper attack path"}

T1543.003 Windows Service

Sub-technique of: T1543

High-Level Description

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API.

Adversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: .sys) to disk, the payload can be loaded and registered via Native API functions such as CreateServiceW() (or manually via functions such as ZwLoadDriver() and ZwSetValueKey()), by creating the required service Registry values (i.e. Modify Registry), or by using command-line utilities such as PnPUtil.exe. Adversaries may leverage these drivers as Rootkits to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of Exploitation for Privilege Escalation.

Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through Service Execution.

To make detection analysis more challenging, malicious services may also incorporate Masquerade Task or Service (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create ‘hidden’ services (i.e., Hide Artifacts), for example by using the sc sdset command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as Get-Service, sc query, and services.exe.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: Windows

What to Check

• Identify if Windows Service technique is applicable to target environment