tfMITRE ATT&CK sub-technique

Service Execution T1569.002

Tactic: Execution
Platform: Windows
Version: 1.3
Created: 10 March 2020
Last modified: 12 May 2026

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.[1] The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 11%

Threat groups89th percentile · 89% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 9%

Campaigns91st percentile · 91% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 7%

Tools & malware93rd percentile · 93% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 3%

Detection rules97th percentile · 97% of ATT&CK techniques have this many detection rules written or fewer.

Service Execution MITRE reference T1569.002

Top 11%of all ATT&CK techniques for number of groups

16 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Medusa GroupG1051 ↗

Has utilized PsExec to execute scripts and commands within victim environments.1 2 3 Medusa Group has also used the Windows service RoboCopy to search and copy data for exfiltration.3

created 2025-10-154 references

Velvet AntG1047 ↗

Executed and installed PlugX as a Windows service.1

created 2025-03-141 reference

BlackByteG1043 ↗

Created malicious services for ransomware execution.1 2

created 2024-12-162 referencesaka Hecamede

Moonstone SleetG1036 ↗

Used intermediate loader malware such as YouieLoader and SplitLoader that create malicious services.1

created 2024-08-261 referenceaka Storm-1789

INC RansomG1032 ↗

Has run a file encryption executable via Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem.1

created 2024-06-061 referenceaka GOLD IONIC

ChimeraG0114 ↗

Has used PsExec to deploy beacons on compromised systems.1

created 2020-08-241 reference

All 16 groups for this technique · 6 newest in this preview

5 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SharePoint ToolShell ExploitationC0058 ↗

During SharePoint ToolShell Exploitation, threat actors leveraged PsExec for command execution and used services.exe to disable Microsoft Defender via Registry keys.1

2025

Operation Digital EyeC0061 ↗

During Operation Digital Eye, threat actors used the winsw tool to deploy a Visual Studio code executable as a Windows service.1

2024

APT41 DUSTC0040 ↗

Used Windows services to execute DUSTPAN.1

2023–2024

Operation WocaoC0014 ↗

During Operation Wocao, threat actors created services on remote systems for execution purposes.1

2017–2019

Operation HoneybeeC0006 ↗

During Operation Honeybee, threat actors ran sc start to start the COMSysApp as part of the service hijacking and sc stop to stop and reconfigure the COMSysApp.1

2017–2018

All 5 campaigns for this technique

51 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

EmbargoS1247 ↗

Has created a service named irnagentd that executed the MDeployer loader after the system is rebooted in Safe Mode.1

created 2025-10-19MALWAREcarried by 1 group

LockBit 3.0S1202 ↗

Can use PsExec to execute commands and payloads.1

created 2025-02-05MALWARE

BlackByte 2.0 RansomwareS1181 ↗

Executes as a service when deployed.1

created 2024-12-17MALWAREcarried by 1 group

DEADWOODS1134 ↗

Can be executed as a service using various names, such as ScDeviceEnums.1

created 2024-05-22MALWAREcarried by 2 groups

IPsec HelperS1132 ↗

Is run as a Windows service in victim environments.1

created 2024-05-22MALWAREcarried by 1 group

DarkGateS1111 ↗

Tries to elevate privileges to SYSTEM using PsExec to locally execute as a service, such as cmd /c c:\temp\PsExec.exe -accepteula -j -d -s [Target Binary].1

created 2024-02-09MALWARE

All 51 software entries for this technique · 6 newest in this preview

Offense vs defense T1569.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 5Sigma rules (cumulative) · 45Splunk ESCU (cumulative) · 11

first rule: 2017 Q1 · 5 of 5 campaigns plotted

Service Execution detection strategy DET0421

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for System Services Service Execution

Enterprise

1 platform

AN1185 · Windows

Detection focuses on abnormal service executions initiated via service control manager APIs, sc.exe, net.exe, or PsExec creating temporary services. Defenders observe process creation of services.exe spawning non-standard binaries, registry changes in service keys followed by rapid execution, and network connections originating from processes tied to transient services. Correlation across process lineage, registry activity, and service logs provides strong signals of malicious service execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Service CreationDC0060	WinEventLog:Security	EventCode=4697
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServiceBinaryAllowlist	Known binaries/services expected to be invoked via services.exe
ParentProcessCorrelationWindow	Time window for correlating service creation with execution events
RemoteExecutionHosts	Approved remote hosts that may trigger service execution (e.g., via PsExec)

4 analytics

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

Adversaries may modify the binary file for an existing service to achieve Persistence while potentially evading defenses. If a newly created or modified runs as a service, it may indicate APT activity. However, services are frequently installed by legitimate software. A well-tuned baseline is essential to differentiating between benign and malicious service modifications.

TypesSituational Awareness, TTPCoverageModerateSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-SBV	Service Binary Verification

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
file	create	file_path
file	create	image_path
process	create	image_path
process	create	parent_exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Look for events where a file was created and then later run as a service. In these cases, a new service has been created or the binary has been modified. Many programs, such as msiexec.exe, do these behaviors legitimately and can be used to help validate legitimate service creations/modifications.

legitimate_installers = ["C:\windows\system32\msiexec.exe", "C:\windows\syswow64\msiexec.exe", ...]

file_change = search File:Create,Modify
process = search Process:Create
service_process = filter processes where (parent_exe == "services.exe")
modified_service = join (search, filter) where (
 file_change.time < service_process.time and
 file_change.file_path == service_process.image_path
)

modified_service = filter modified_service where (modified_service.file_change.image_path not in legitimate_installers)
output modified_service

There are several ways to cause code to execute on a remote host. One of the most common methods is via the Windows Service Control Manager (SCM), which allows authorized users to remotely create and modify services. Several tools, such as PsExec, use this functionality.

TypeTTPCoverageModerateSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-RTA	RPC Traffic Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	start	pid
process	create	parent_exe
process	create	pid

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Look for processes launched from services.exe within 1 second of services.exe receiving a network connection.

process = search Process:Create
flow = search Flow:Start
service = filter process where (parent_exe == "services.exe")
remote_start = join (flow, service ) where (
 flow.hostname == service.hostname and
 flow.pid == service.pid and
 (flow.time < service.time < flow.time + 1 second)
)
output remote_start

This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows.

TypeTTPCoverageModerateSubmitted2021

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
service	create	image_path

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Pseudocode implementation of the Splunk search below.

services = search Service:create
suspicious_services = filter services where image_path = "*\.exe" AND image_path does not contain ["C:\\Windows\\*", "%windir%\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*"] )
output suspicious_services

To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.

 `wineventlog_system` EventCode=7045  Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "%windir%\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) Service_Type = "user mode service" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type

Unit tests

CAR’s own validation procedures for this analytic.

Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log) using the Splunk attack range with the commands below

["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]

execute the atomic test [T1569.001](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1569.001) against a Windows target.

["Invoke-AtomicTest T1569.001"]

Tests8Executorscmd 5 · PowerShell 2 · bash 1Need elevation6 of 8Have prerequisites5Have cleanup3Platformswindows, linux

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Execute a Command as a Service windows cmd Required — Yes

Creates a service specifying an arbitrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly. Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file art-marker.txt BlackCat Ransomware (ALPHV) Cybereason vs. BlackCat Ransomware

Input arguments

Name	Type	Default	Description
service_name	string	ARTService	Name of service to create
executable_command	string	%COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType File C:\art-marker.txt	Command to execute as a service

Attack command

sc.exe create #{service_name} binPath= "#{executable_command}"
sc.exe start #{service_name}
sc.exe delete #{service_name}

Cleanup command

del C:\art-marker.txt >nul 2>&1

GUIDfca0ce73-a963-438d-82b4-aa03d038825d

02 Use PsExec to execute a command on a remote host windows cmd Required 1 —

Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments Will start a process on a remote host. Upon successful execution, cmd will utilize psexec.exe to spawn calc.exe on a remote endpoint (default:localhost).

Input arguments

Name	Type	Default	Description
password	string	P@ssw0rd1	Password
user_name	string	DOMAIN\Administrator	Username
remote_host	string	localhost	Remote hostname or IP address

Attack command

"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host} -i -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"

Prerequisite

PsExec tool from Sysinternals must exist in the ExternalPayloads directory

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") { exit 0} else { exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force

GUID739cc791-1778-47b3-a665-ae20b41a0460

03 psexec.py (Impacket) linux bash — 1 —

Will execute a command on the remote host with Impacket psexec.py script.

Input arguments

Name	Type	Default	Description
domain	string		Target domain
command	string	whoami	Command to execute in target computer
password	string	P@ssw0rd1	Password
username	string	Administrator	Username
remote_host	string	127.0.0.1	Remote hostname or IP address

Attack command

psexec.py '#{domain}/#{username}:#{password}@#{remote_host}' '#{command}'

Prerequisite

psexec.py (Impacket)

Check

if [ -x "$(command -v psexec.py)" ]; then exit 0; else exit 1; fi;

Satisfy

sudo pip3 install impacket

GUID36065646-14f1-449a-b43a-7612d9da5130

04 BlackCat pre-encryption cmds with Lateral Movement windows PowerShell Required 1 Yes

This atomic attempts to emulate the unique behavior of BlackCat ransomware prior to encryption and during Lateral Movement attempts via PsExec on Windows. Uses bundled PsExec like BlackCat

Input arguments

Name	Type	Default	Description
targethost	string	$ENV:COMPUTERNAME	Target hostname to attempt psexec connection to for emulation of lateral movement.

Attack command

cmd.exe /c "wmic 	csproduct 	get UUID" 
cmd.exe /c "fsutil behavior 	set SymlinkEvaluation R2L:1" 
cmd.exe /c "fsutil behavior set 	SymlinkEvaluation R2R:1"
reg    add    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters    /v MaxMpxCt /d 65535 /t REG_DWORD /f      
copy "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" $env:temp
cmd.exe /c "$env:temp\psexec.exe  -accepteula  \\#{targethost} cmd.exe  /c echo "--access-token""

Cleanup command

reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /f
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:0" 
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:0"
rm $env:temp\psexec.exe

Prerequisite

PsExec must exist on disk at "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe"

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") {exit 0} else {exit 1}

Satisfy

Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
New-Item -ItemType Directory (Split-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force

GUID9d791b45-18b4-4ac5-8afb-79e3fc9986fc

05 Use RemCom to execute a command on a remote host windows cmd — 1 —

Requires having RemCom installed, path to RemCom is one of the input input_arguments Will start a process on a remote host. Upon successful execution, cmd will utilize RemCom.exe to spawn calc.exe on a remote endpoint (default:localhost).

Input arguments

Name	Type	Default	Description
password	string	P@ssw0rd1	Password
user_name	string	Administrator	Username
remote_host	string	localhost	Remote hostname or IP address

Attack command

"PathToAtomicsFolder\..\ExternalPayloads\remcom.exe" \\#{remote_host} /user:#{user_name} /pwd:#{password} cmd.exe

Prerequisite

RemCom tool must exist on disk in the ExternalPayloads folder

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe") { exit 0} else { exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/kavika13/RemCom/raw/master/bin/Release/RemCom.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe"

GUIDdb59750b-5c9a-4217-835f-e6398d207d9b

06 Snake Malware Service Create windows cmd Required — Yes

The following Atomic Test will create a new service named WerFaultSvc with a binary path of WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe. This was recently seen in the Snake Malware report. Upon execution, sc.exe will create a new service named WerFaultSvc with a bin path \WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe and a display name of WerFault Service. Snake Malware - CISA

Attack command

sc.exe create "WerFaultSvc" binPath= "$env:windir\WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe" DisplayName= "WerFault Service" start= auto

Cleanup command

sc.exe delete "WerFaultSvc"

GUIDc1039f89-7e15-45ec-b467-9b01e93a3a2e

07 Modifying ACL of Service Control Manager via SDET windows cmd Required — —

Modify permissions of Service Control Manager via SDSET. This allows any administrative user to escalate privilege and create a service with SYSTEM level privileges.Restart is required. Blog

Attack command

sc.exe sdset scmanager D:(A;;KA;;;WD)

GUID5cc53f7e-25e6-4e1f-895c-7257412f6906

08 Pipe Creation - PsExec Tool Execution From Suspicious Locations windows PowerShell Required 1 —

Requires PsExec tool installed. BlackCat Ransomeware tried to propagate by creating pipe using PsExec process executing from suspicious locations (In the particular case the legitimate PsExec executable is embedded within the Windows variant and is dropped in the victim’s %TEMP% directory). pon successful execution, PsExec will be executed from suspicious location and create a new pipe to execute CMD.

Attack command

cd C:\Users\Public\Temp\ 
.\PsExec.exe -i -s cmd  -accepteula

Prerequisite

PsExec tool from Sysinternals must exist in the '\Users\Public\Temp\' directory

Check

if (Get-ChildItem -Path C:\ -Include *psexec* -File -Recurse -ErrorAction SilentlyContinue) {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "C:\Users\Public\Temp\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "C:\Users\Public\Temp\PSTools.zip"
Expand-Archive "C:\Users\Public\Temp\PsTools.zip" "C:\Users\Public\Temp\" -Force

GUID35350a57-802c-4cc2-ad4d-321a337ab494

Tests from Atomic Red Team (MIT licence) · technique definition

Service Execution detections T1569.002

56 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 3%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs