T1569.002Execution
Service Execution
Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services. The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. PsExec can also be used to execute commands or payloads via a temporary…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
43 Sigma rules tagged T1569.002Service ExecutionT1569.00243 general rules
- CobaltStrike Service Installations - Systemcriticaltest
- CosmicDuke Service Installationcriticaltest
- DNS RCE CVE-2020-1350criticaltest
- HackTool - SharpUp PrivEsc Tool Executioncriticaltest
- CobaltStrike Service Installations - Securityhightest
- Credential Dumping Tools Service Execution - Securityhightest
- Credential Dumping Tools Service Execution - Systemhightest
- HackTool Service Registration or Executionhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Service Execution
1 CVE, by priority. Each link shows its badge.- CVE-2021-35394Realtek Jungle SDK Remote Code Execution VulnerabilityRealtek · Jungle Software Development Kit (SDK)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 moreMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.04%69.9priority