T1050.md

T1050 - New Service

Description from ATT&CK

When operating systems boot up, they can start programs or applications called services that perform background system functions. (Citation: TechNet Services) A service's configuration information, including the file path to the service's executable, is stored in the Windows Registry.

Adversaries may install a new service that can be configured to execute at startup by using utilities to interact with services or by directly modifying the Registry. The service name may be disguised by using a name from a related operating system or benign software with Masquerading. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. Adversaries may also directly start services through Service Execution.

Atomic Tests

• Atomic Test #1 - Service Installation

• Atomic Test #2 - Service Installation PowerShell Installs A Local Service using PowerShell

Atomic Test #1 - Service Installation

Installs A Local Service

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
binary_path	Name of the service binary, include path.	Path	PathToAtomicsFolder\T1050\bin\AtomicService.exe
service_name	Name of the Service	String	AtomicTestService

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

sc.exe create #{service_name} binPath= #{binary_path}
sc.exe start #{service_name}

Cleanup Commands:

sc.exe stop #{service_name}
sc.exe delete #{service_name}

Atomic Test #2 - Service Installation PowerShell Installs A Local Service using PowerShell

Installs A Local Service via PowerShell

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
binary_path	Name of the service binary, include path.	Path	PathToAtomicsFolder\T1050\bin\AtomicService.exe
service_name	Name of the Service	String	AtomicTestService

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

New-Service -Name "#{service_name}" -BinaryPathName "#{binary_path}" 2>&1 | Out-Null
Start-Service -Name "#{service_name}"

Cleanup Commands:

Stop-Service -Name "#{service_name}" 2>&1 | Out-Null
try {(Get-WmiObject Win32_Service -filter "name='#{service_name}'").Delete()}
catch {}