Wiki › Techniques, Tactics & Procedures (TTPs) › Persistence › Service Creation Persistence

Service Creation Persistence

3 min read

Jump to:

Overview

Service Creation Persistence is a technique used by adversaries to maintain long-term access to compromised systems by creating or modifying system services. This technique plays a critical role in the persistence phase of the attack lifecycle, enabling attackers to execute code automatically upon system startup or at scheduled intervals. Adversaries leverage this method to ensure continued control and evade detection by integrating their payloads into legitimate system processes.

Attack Objective

Establish and maintain persistent access to a target system
Supports the Persistence stage of the attack lifecycle, with potential impact on Execution and Privilege Escalation stages
Advances the attacker’s position by enabling automatic execution of malicious code without user interaction, facilitating stealthy long-term presence

How the Technique Works

Adversaries create new system services or alter existing ones to execute malicious payloads during system boot or on demand. By registering these services with the operating system’s service manager, attackers ensure their code runs with specified privileges and can restart automatically if terminated. This integration with native service frameworks allows the malicious code to blend with legitimate system activity, complicating detection and removal efforts.

Common Methods & Variations

Creation of new services configured to run attacker-controlled executables or scripts
Modification of existing legitimate services to load malicious binaries or inject code
Use of on-premises Windows Service Control Manager (SCM) or Linux systemd/init services
Cloud environments leveraging managed service frameworks or container orchestration services for persistence
Living-off-the-land approaches using built-in system utilities (e.g., sc.exe, systemctl) versus deployment of custom service binaries

Indicators of Compromise (IOCs)

Unexpected or unauthorized new service registrations in system logs
Changes to service configurations or binary paths inconsistent with baseline
Service start events occurring outside normal operational patterns
Endpoint artifacts such as unusual service executables or scripts residing in system directories
Network connections initiated by service processes to suspicious external hosts

Detection Strategies

Monitoring service creation, modification, and start events via system and security logs
Behavioral analysis to identify anomalous service activity or deviations from established baselines
Correlation of service-related events with other suspicious behaviors such as privilege escalation or lateral movement
Use of endpoint detection and response (EDR) tools to track service process lineage and associated file changes

Mitigation & Prevention

Implement least privilege principles to restrict service creation and modification rights
Enforce application whitelisting and code signing policies for service binaries
Harden service configurations by disabling unnecessary services and restricting service startup types
Regularly audit and monitor service registries and configurations for unauthorized changes
Use multi-factor authentication and strong credential management to protect administrative accounts

Response Considerations

Immediately disable or remove unauthorized services to contain active persistence mechanisms
Conduct thorough system and network investigations to identify scope and related malicious activity
Perform root cause analysis to determine initial compromise vector and persistence establishment
Rebuild or harden affected systems to prevent re-establishment of malicious services
Update detection rules and conduct user awareness training to reduce future risk

Related Techniques

Scheduled Task/Job Persistence – alternative method for automated code execution
Registry Run Keys / Startup Folder – other persistence mechanisms on Windows systems
Process Injection – often combined to hide malicious service payloads
Credential Dumping – to gain privileges required for service creation
Command and Control – services may facilitate communication channels

Mapping & References

MITRE ATT&CK Tactic: Persistence
MITRE ATT&CK Technique: Service Execution (T1569.002)
MITRE ATT&CK Sub-technique: New Service (T1543.003)
Public advisories and incident reports detailing service-based persistence methods
Vendor-neutral whitepapers on service hardening and detection best practices

Tags: Attack Lifecycle Cybersecurity Detection endpoint security Incident Response Mitigation MITRE ATT&CK persistence Service Creation threat hunting