Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. Windows stores local service configuration information in the Registry underHKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service) If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). Adversaries may also alter other Registry keys in the service’s Registry tree. For example, theFailureCommandkey may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness) ThePerformancekey contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) If thePerformancekey is not already present and if an adversary-controlled user has theCreate Subkeypermission, adversaries may create thePerformancekey in the service’s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms) Adversaries may also add theParameterskey, which stores driver-specific data, or other custom subkeys for their malicious services to establish persistence or enable other malicious activities.(Citation: microsoft_services_registry_tree)(Citation: troj_zegost) Additionally, If adversaries launch their malicious services using svchost.exe, the service’s file may be identified usingHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\servicename\Parameters\ServiceDll.(Citation: malware_hides_service)
Service registry permissions weakness check and then which can lead to privilege escalation with ImagePath. eg. reg add “HKLM\SYSTEM\CurrentControlSet\Services#{weak_service_name}” /f /v ImagePath /d “C:\temp\AtomicRedteam.exe”
Supported Platforms: Windows
auto_generated_guid: f7536d63-7fd4-466f-89da-7e48d550752a
| Name | Description | Type | Default Value | |——|————-|——|—————| | weak_service_name | weak service check | string | weakservicename|
1
powershell
1
2
get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\* |FL
get-acl REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name} |FL
Change Service registry ImagePath of a bengin service to a malicious file
Supported Platforms: Windows
auto_generated_guid: f38e9eea-e1d7-4ba6-b716-584791963827
| Name | Description | Type | Default Value | |——|————-|——|—————| | weak_service_name | weak service name | string | calcservice| | weak_service_path | weak service path | string | %windir%\system32\win32calc.exe| | malicious_service_path | malicious service path | string | %windir%\system32\cmd.exe|
1
command_prompt
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\#{weak_service_name}" /f /v ImagePath /d "#{malicious_service_path}"
sc.exe delete #{weak_service_name}
1
powershell
1
if (Get-Service #{weak_service_name}) {exit 0} else {exit 1}
1
sc.exe create #{weak_service_name} binpath= "#{weak_service_path}"