Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0421 — Detection Strategy for System Services Service Execution
DET0421

Detection Strategy for System Services Service Execution

1 analytic(s) · 1 technique(s) detected

Analytics

1
AN1185 Analytic 1185
Windows

Detection focuses on abnormal service executions initiated via service control manager APIs, sc.exe, net.exe, or PsExec creating temporary services. Defenders observe process creation of services.exe spawning non-standard binaries, registry changes in service keys followed by rapid execution, and network connections originating from processes tied to transient services. Correlation across process lineage, registry activity, and service logs provides strong signals of malicious service execution.

WinEventLog:Security EventCode=4697 WinEventLog:Sysmon EventCode=1 WinEventLog:Sysmon EventCode=13, 14 WinEventLog:Sysmon EventCode=3, 22
[ServiceBinaryAllowlist] Known binaries/services expected to be invoked via services.exe
[ParentProcessCorrelationWindow] Time window for correlating service creation with execution events
[RemoteExecutionHosts] Approved remote hosts that may trigger service execution (e.g., via PsExec)

Detected Techniques

1

Details

MITRE ID
DET0421
STIX ID
x-mitre-detection-strategy--ef1996dc-b6e9-4d8b-a216-77d14323b3e5
Analytics
1
Techniques Detected
1
By Tactic
Execution
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.