t1569-system-services

name	T1569_system-services
description	Adversaries may abuse system services or daemons to execute commands or programs.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1569","execution","windows","macos","linux"]
technique_id	T1569
tactic	execution
all_tactics	["execution"]
platforms	["Windows","macOS","Linux"]
mitre_url	https://attack.mitre.org/techniques/T1569
tech_stack	["windows","macos","linux"]
cwe_ids	["CWE-94"]
chains_with	["T1569.001","T1569.002","T1569.003"]
prerequisites	[]
severity_boost	{"T1569.001":"Chain with T1569.001 for deeper attack path","T1569.002":"Chain with T1569.002 for deeper attack path","T1569.003":"Chain with T1569.003 for deeper attack path"}

T1569 System Services

High-Level Description

Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence (Create or Modify System Process), but adversaries can also abuse services for one-time or temporary execution.

Kill Chain Phase

• Execution (TA0002)

Platforms: Windows, macOS, Linux

What to Check

• Identify if System Services technique is applicable to target environment
• Check Windows systems for indicators of System Services
• Check macOS systems for indicators of System Services
• Check Linux systems for indicators of System Services
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to System Services by examining the target platforms (Windows, macOS, Linux).

2. Assess Existing Defenses: Review whether mitigations for T1569 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1026 Privileged Account Management

Ensure that permissions disallow services that run at a higher permissions level from being created or interacted with by a user with a lower permission level.

M1018 User Account Management

Prevent users from installing their own launch agents or launch daemons.

M1040 Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by PsExec from running.

M1022 Restrict File and Directory Permissions