Try it using Invoke-Atomic

System Services: Service Execution

Description from ATT&CK

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and Net.

PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as PsExec and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution.

Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation. https://www.aleksandrhovhannisyan.com/blog/how-to-add-a-copy-to-clipboard-button-to-your-jekyll-blog/

Atomic Tests

Atomic Test #1 - Execute a Command as a Service

Creates a service specifying an aribrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.

Upon successful execution, cmd.exe create a new service using sc.exe create that will start powershell.exe to create a new file 

1

art-marker.txt

Supported Platforms: windows

auto_generated_guid: 2382dee2-a75f-49aa-9378-f52df6ed3fb1

Inputs:

Name Description Type Default Value
service_name Name of service to create string ARTService
executable_command Command to execute as a service string %COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType File C:\art-marker.txt

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

1
2
3
4

sc.exe create #{service_name} binPath= "#{executable_command}"
sc.exe start #{service_name}
sc.exe delete #{service_name}

Cleanup Commands:

1
2

del C:\art-marker.txt >nul 2>&1

Atomic Test #2 - Use PsExec to execute a command on a remote host

Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments Will start a process on a remote host.

Upon successful execution, cmd will utilize psexec.exe to spawn calc.exe on a remote endpoint (default:localhost).

Supported Platforms: windows

auto_generated_guid: 873106b7-cfed-454b-8680-fa9f6400431c

Inputs:

Name Description Type Default Value
remote_host Remote hostname or IP address string localhost
user_name Username String DOMAIN\Administrator
password Password String P@ssw0rd1
psexec_exe Path to PsExec string C:\PSTools\PsExec.exe

Attack Commands: Run with command_prompt!

1
2

#{psexec_exe} \\#{remote_host} -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"

Dependencies: Run with command_prompt!

Description: PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_exe})

Check Prereq Commands:

1
2

if (Test-Path "#{psexec_exe}") { exit 0} else { exit 1}

Get Prereq Commands:

1
2
3
4
5

Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip"
Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force
New-Item -ItemType Directory (Split-Path "#{psexec_exe}") -Force | Out-Null
Copy-Item $env:TEMP\PsTools\PsExec.exe "#{psexec_exe}" -Force

source