2026-04-13 08-09-30

May 25, 2026 14:23 · 8:30 · English · Whisper Turbo · 2 സ്പീക്കറുകള്‍
ഈ തീയതിയുടെ കാലാവധി ഇന്നു് തീരുന്നു. സ്ഥിരമായുള്ള സ്റ്റോറേജ് അപ്ഗ്രേഡ് ചെയ്യുക →
ലാപ്‌സ് ഇന്‍ഡെക്സ്
കാണിക്കല്‍ മാത്രം.
0:03
S… Speaker 1 (2026-04-13 08-09-30)
In this video,
0:04
S… Speaker 2 (2026-04-13 08-09-30)
we're going to take a look at how attackers can abuse Windows
0:09
S… Speaker 2 (2026-04-13 08-09-30)
services and also some indicators that can be used to
0:13
S… Speaker 2 (2026-04-13 08-09-30)
search for malicious activity around those Windows services.
0:18
S… Speaker 1 (2026-04-13 08-09-30)
So first of all,
0:19
S… Speaker 2 (2026-04-13 08-09-30)
what exactly is a service?
0:21
S… Speaker 2 (2026-04-13 08-09-30)
Really easy.
0:22
S… Speaker 2 (2026-04-13 08-09-30)
This is just any sort of process that is just running in the background
0:27
S… Speaker 2 (2026-04-13 08-09-30)
of a machine.
0:28
S… Speaker 2 (2026-04-13 08-09-30)
Regular processes that are running in the background are usually going
0:32
S… Speaker 2 (2026-04-13 08-09-30)
to be considered a service.
0:34
S… Speaker 1 (2026-04-13 08-09-30)
Now,
0:35
S… Speaker 2 (2026-04-13 08-09-30)
there's a lot of different ways that you can have your services start.
0:38
S… Speaker 2 (2026-04-13 08-09-30)
You can have your services start on boot when the system boots up or
0:43
S… Speaker 2 (2026-04-13 08-09-30)
when a user logs in.
0:44
S… Speaker 2 (2026-04-13 08-09-30)
This is what's known as an automatic start.
0:46
S… Speaker 2 (2026-04-13 08-09-30)
Or there can be some sort of other trigger.
0:48
S… Speaker 2 (2026-04-13 08-09-30)
This can be manually by a user or typically an administrator
0:53
S… Speaker 2 (2026-04-13 08-09-30)
or some other sort of trigger for that service.
0:56
S… Speaker 2 (2026-04-13 08-09-30)
There's many different options when it comes to launching a service in Windows.
1:01
S… Speaker 2 (2026-04-13 08-09-30)
There's a few different ways that attackers can
1:05
S… Speaker 2 (2026-04-13 08-09-30)
abuse these services,
1:06
S… Speaker 2 (2026-04-13 08-09-30)
and they commonly are going to abuse them for some sort of a persistence
1:11
S… Speaker 2 (2026-04-13 08-09-30)
mechanism.
1:12
S… Speaker 2 (2026-04-13 08-09-30)
This can be a malicious process that they have on the system that they
1:16
S… Speaker 2 (2026-04-13 08-09-30)
want to have starting at boot.
1:18
S… Speaker 2 (2026-04-13 08-09-30)
It can be used to connect to their command and control infrastructure
1:23
S… Speaker 2 (2026-04-13 08-09-30)
so that the system,
1:24
S… Speaker 2 (2026-04-13 08-09-30)
the malware on that system,
1:26
S… Speaker 2 (2026-04-13 08-09-30)
can get additional instructions from whatever that C2 infrastructure is.
1:30
S… Speaker 2 (2026-04-13 08-09-30)
And it can also be used to ensure elevated access on a
1:34
S… Speaker 1 (2026-04-13 08-09-30)
system.
1:35
S… Speaker 2 (2026-04-13 08-09-30)
It can be some repeating process that runs.
1:38
S… Speaker 2 (2026-04-13 08-09-30)
Either when a user logs into the computer or on a regular schedule.
1:42
S… Speaker 2 (2026-04-13 08-09-30)
Usually a regular schedule will be something more like a scheduled task.
1:45
S… Speaker 2 (2026-04-13 08-09-30)
Those can accomplish very similar objectives for an attacker.
1:49
S… Speaker 2 (2026-04-13 08-09-30)
But these are a few reasons that attackers will commonly abuse
1:54
S… Speaker 2 (2026-04-13 08-09-30)
Windows services.
1:56
S… Speaker 2 (2026-04-13 08-09-30)
And there are some ways to be able to identify this and some ways that attackers do
2:00
S… Speaker 1 (2026-04-13 08-09-30)
abuse them.
2:01
S… Speaker 2 (2026-04-13 08-09-30)
Number one is going to be creating a new service.
2:04
S… Speaker 2 (2026-04-13 08-09-30)
And there's several different ways that attackers can do this.
2:08
S… Speaker 2 (2026-04-13 08-09-30)
They can do it with the sc .exe command with the create
2:12
S… Speaker 1 (2026-04-13 08-09-30)
option.
2:12
S… Speaker 2 (2026-04-13 08-09-30)
They can use the PowerShell commandlet new service.
2:16
S… Speaker 2 (2026-04-13 08-09-30)
Or they can run various different WMI commands that can
2:20
S… Speaker 2 (2026-04-13 08-09-30)
be used to create services as well.
2:23
S… Speaker 2 (2026-04-13 08-09-30)
And there are registry modifications specifically to the
2:27
S… Speaker 2 (2026-04-13 08-09-30)
current control set services registry key,
2:31
S… Speaker 2 (2026-04-13 08-09-30)
where the attackers can create new keys in there
2:35
S… Speaker 2 (2026-04-13 08-09-30)
to be able to kind of register services on the
2:39
S… Speaker 1 (2026-04-13 08-09-30)
system.
2:40
S… Speaker 2 (2026-04-13 08-09-30)
And there's various third -party tools that can be used to create malicious
2:44
S… Speaker 1 (2026-04-13 08-09-30)
services.
2:45
S… Speaker 2 (2026-04-13 08-09-30)
Now, keep in mind here that...
2:48
S… Speaker 2 (2026-04-13 08-09-30)
Services themselves are a normal part of really any Windows
2:52
S… Speaker 1 (2026-04-13 08-09-30)
systems.
2:53
S… Speaker 2 (2026-04-13 08-09-30)
They're required for Windows systems to function.
2:55
S… Speaker 2 (2026-04-13 08-09-30)
But they're also used by applications,
2:58
S… Speaker 2 (2026-04-13 08-09-30)
regular legitimate applications as well.
3:00
S… Speaker 2 (2026-04-13 08-09-30)
So new services on a system is a perfectly legitimate thing,
3:05
S… Speaker 2 (2026-04-13 08-09-30)
which is a reason why attackers abuse them,
3:08
S… Speaker 2 (2026-04-13 08-09-30)
because it is a legitimate process.
3:12
S… Speaker 1 (2026-04-13 08-09-30)
They can also,
3:13
S… Speaker 2 (2026-04-13 08-09-30)
in addition to creating new services,
3:15
S… Speaker 2 (2026-04-13 08-09-30)
they can also modify or replace existing
3:19
S… Speaker 1 (2026-04-13 08-09-30)
services.
3:20
S… Speaker 2 (2026-04-13 08-09-30)
Now, this modification does require either the attacker to
3:24
S… Speaker 2 (2026-04-13 08-09-30)
have proper access to the system to be able to modify existing services,
3:29
S… Speaker 2 (2026-04-13 08-09-30)
or for the service to have been
3:33
S… Speaker 2 (2026-04-13 08-09-30)
configured with weak permissions that allows a regular user
3:37
S… Speaker 2 (2026-04-13 08-09-30)
account to be able to modify that service.
3:41
S… Speaker 1 (2026-04-13 08-09-30)
they can essentially,
3:43
S… Speaker 2 (2026-04-13 08-09-30)
there's a couple different things they can do.
3:45
S… Speaker 2 (2026-04-13 08-09-30)
One of the main things they'll do when they're modifying a service is just change what
3:49
S… Speaker 2 (2026-04-13 08-09-30)
executable that service is going to launch.
3:51
S… Speaker 2 (2026-04-13 08-09-30)
Instead of pointing it at whatever legitimate purpose the service was there for,
3:55
S… Speaker 2 (2026-04-13 08-09-30)
they'll point it at the malicious payload that they have on
3:59
S… Speaker 1 (2026-04-13 08-09-30)
the system.
4:00
S… Speaker 2 (2026-04-13 08-09-30)
They can also change the recovery options on a service.
4:05
S… Speaker 2 (2026-04-13 08-09-30)
Recovery options are basically what happens when the
4:09
S… Speaker 2 (2026-04-13 08-09-30)
service stops unexpectedly or fails for whatever reason.
4:13
S… Speaker 2 (2026-04-13 08-09-30)
There are many different options that can be enabled as
4:17
S… Speaker 2 (2026-04-13 08-09-30)
a recovery option for a service,
4:19
S… Speaker 2 (2026-04-13 08-09-30)
and one of those is to launch a program when
4:24
S… Speaker 2 (2026-04-13 08-09-30)
the service fails.
4:26
S… Speaker 2 (2026-04-13 08-09-30)
So that is another thing an attacker can modify on a service
4:30
S… Speaker 2 (2026-04-13 08-09-30)
to be able to...
4:32
S… Speaker 2 (2026-04-13 08-09-30)
kind of use it for malicious intent there.
4:36
S… Speaker 1 (2026-04-13 08-09-30)
Now,
4:37
S… Speaker 2 (2026-04-13 08-09-30)
attackers might,
4:38
S… Speaker 1 (2026-04-13 08-09-30)
a lot of times,
4:39
S… Speaker 2 (2026-04-13 08-09-30)
will try to modify legitimate Windows services.
4:42
S… Speaker 2 (2026-04-13 08-09-30)
Now, there are some protections against that,
4:44
S… Speaker 2 (2026-04-13 08-09-30)
but the key to remember there is just because the name
4:49
S… Speaker 2 (2026-04-13 08-09-30)
of a service is a legitimate Windows service doesn't
4:53
S… Speaker 2 (2026-04-13 08-09-30)
actually mean it should be trusted.
4:55
S… Speaker 2 (2026-04-13 08-09-30)
You always want to verify those.
4:58
S… Speaker 2 (2026-04-13 08-09-30)
There's some ways you can recognize the abuse of Windows services
5:02
S… Speaker 2 (2026-04-13 08-09-30)
and recognize the creation or modification of these malicious
5:07
S… Speaker 1 (2026-04-13 08-09-30)
services.
5:07
S… Speaker 1 (2026-04-13 08-09-30)
Remember,
5:08
S… Speaker 2 (2026-04-13 08-09-30)
any application can create a service as long as it's been given
5:12
S… Speaker 2 (2026-04-13 08-09-30)
the proper access to do that.
5:15
S… Speaker 1 (2026-04-13 08-09-30)
So when we're looking,
5:16
S… Speaker 2 (2026-04-13 08-09-30)
when we're performing our endpoint threat hunts,
5:18
S… Speaker 2 (2026-04-13 08-09-30)
there's several different indicators you can look for for service creation.
5:23
S… Speaker 2 (2026-04-13 08-09-30)
We've looked at these briefly already.
5:25
S… Speaker 2 (2026-04-13 08-09-30)
So you have sc .exe.
5:27
S… Speaker 2 (2026-04-13 08-09-30)
This is a command line program that can be used to manage
5:31
S… Speaker 2 (2026-04-13 08-09-30)
these services.
5:32
S… Speaker 2 (2026-04-13 08-09-30)
So if you see sc .exe create,
5:36
S… Speaker 1 (2026-04-13 08-09-30)
in the logs,
5:38
S… Speaker 2 (2026-04-13 08-09-30)
that is an indication that a service was created.
5:41
S… Speaker 2 (2026-04-13 08-09-30)
Now, whether or not it's malicious or not requires additional context and additional
5:45
S… Speaker 2 (2026-04-13 08-09-30)
analysis and investigation.
5:47
S… Speaker 2 (2026-04-13 08-09-30)
You also have the PowerShell commandlet new service.
5:51
S… Speaker 2 (2026-04-13 08-09-30)
If you see that in the logs,
5:53
S… Speaker 2 (2026-04-13 08-09-30)
it is an indication that a service was created.
5:55
S… Speaker 1 (2026-04-13 08-09-30)
And again,
5:56
S… Speaker 2 (2026-04-13 08-09-30)
if you see reg add,
5:58
S… Speaker 2 (2026-04-13 08-09-30)
the command line utility used to create a new registry key,
6:02
S… Speaker 2 (2026-04-13 08-09-30)
In this registry key,
6:04
S… Speaker 2 (2026-04-13 08-09-30)
it's on screen here,
6:05
S… Speaker 2 (2026-04-13 08-09-30)
the current control set services.
6:07
S… Speaker 2 (2026-04-13 08-09-30)
That is another indicator you can use to search
6:11
S… Speaker 2 (2026-04-13 08-09-30)
during an endpoint threat hunt for a malicious service creation.
6:15
S… Speaker 2 (2026-04-13 08-09-30)
In addition to just the reg add command,
6:20
S… Speaker 2 (2026-04-13 08-09-30)
you can also search for specific event IDs
6:24
S… Speaker 2 (2026-04-13 08-09-30)
tied to Sysmon.
6:25
S… Speaker 2 (2026-04-13 08-09-30)
So event IDs 12,
6:27
S… Speaker 1 (2026-04-13 08-09-30)
13,
6:27
S… Speaker 1 (2026-04-13 08-09-30)
and 14.
6:28
S… Speaker 2 (2026-04-13 08-09-30)
12 is for creating and deleting registry
6:32
S… Speaker 1 (2026-04-13 08-09-30)
entries.
6:33
S… Speaker 2 (2026-04-13 08-09-30)
13 is for setting a value for registry key.
6:37
S… Speaker 2 (2026-04-13 08-09-30)
And 14 is a key or a value being renamed.
6:42
S… Speaker 2 (2026-04-13 08-09-30)
In addition to Sysmon,
6:46
S… Speaker 2 (2026-04-13 08-09-30)
you have some built -in Windows event IDs that are
6:50
S… Speaker 2 (2026-04-13 08-09-30)
associated with new service creation.
6:53
S… Speaker 2 (2026-04-13 08-09-30)
Both 4698 and 7045
6:57
S… Speaker 2 (2026-04-13 08-09-30)
can be used as indicators to determine when
7:01
S… Speaker 2 (2026-04-13 08-09-30)
a new service has been created on a system.
7:05
S… Speaker 2 (2026-04-13 08-09-30)
Essentially,
7:05
S… Speaker 2 (2026-04-13 08-09-30)
both of those event IDs are the exact same thing.
7:08
S… Speaker 2 (2026-04-13 08-09-30)
They are for a new service was installed on the system.
7:12
S… Speaker 2 (2026-04-13 08-09-30)
So a number of different indicators that can be used
7:16
S… Speaker 2 (2026-04-13 08-09-30)
to find when services have been created that
7:21
S… Speaker 2 (2026-04-13 08-09-30)
will be in various different locations in logs,
7:23
S… Speaker 2 (2026-04-13 08-09-30)
depending on what you're looking for and what the logging capabilities of that system
7:28
S… Speaker 1 (2026-04-13 08-09-30)
were.
7:29
S… Speaker 1 (2026-04-13 08-09-30)
Also,
7:30
S… Speaker 2 (2026-04-13 08-09-30)
something you want to keep an eye out for is any sort of unrecognized user
7:34
S… Speaker 2 (2026-04-13 08-09-30)
or unauthorized user.
7:36
S… Speaker 2 (2026-04-13 08-09-30)
Just because the account that's creating it has the permissions
7:40
S… Speaker 2 (2026-04-13 08-09-30)
to create a service on a system doesn't necessarily
7:45
S… Speaker 2 (2026-04-13 08-09-30)
mean that they are authorized to create that service.
7:49
S… Speaker 2 (2026-04-13 08-09-30)
Keep that distinction in mind there.
7:52
S… Speaker 2 (2026-04-13 08-09-30)
So looking for any unauthorized or unrecognized accounts that are
7:56
S… Speaker 2 (2026-04-13 08-09-30)
either creating or modifying services is a really good
8:00
S… Speaker 2 (2026-04-13 08-09-30)
indicator you can search for for any sort of malicious activity
8:04
S… Speaker 2 (2026-04-13 08-09-30)
around services also.
8:06
S… Speaker 2 (2026-04-13 08-09-30)
So Windows services are very commonly abused by attackers,
8:09
S… Speaker 2 (2026-04-13 08-09-30)
typically for persistence mechanisms again.
8:12
S… Speaker 2 (2026-04-13 08-09-30)
So definitely something you want to keep in mind when
8:17
S… Speaker 2 (2026-04-13 08-09-30)
you're performing your endpoint threat hunts.

ഈ അക്ഷം AI (സ്വയമുണ്ടായി അക്ഷരാനുഗ്രഹം) ഉണ്ടാക്കിയത്. പിശകുകള്‍ ഉള്‍ക്കൊള്ളാം. അല്ലെങ്കില്‍ മൂല ഓഡിയോ ഉപയോഗിക്കുന്നതിനു് മുന്‍കൂട്ടിയുള്ള പിശകുകള്‍ സ്ഥിതീകരിക്കാം. ഐഐ നയം

❤️ സ്നേഹം STT.ai? കൂട്ടുകാരോട് പറയൂ!
സാരാംശം
ഈ അക്ഷരമാലയുടെ AI സമ്മറി ഉണ്ടാക്കാന്‍ കെസ്റ്റെല്‍ ക്ലിക്ക് ചെയ്യുക.
സഖാവ്...
ഈ ട്രാന്‍സ്പെക്റ്റിനെ കുറിച്ച് AI ചോദിയ്ക്കുക
ഈ പുസ്‌തകത്തെക്കുറിച്ച് എന്തെങ്കിലും ചോദിക്കുക — AI - ന്‌ ആവശ്യമായ ഭാഗങ്ങൾ കണ്ടെത്തുകയും ഉത്തരം നൽകുകയും ചെയ്യും.
വീണ്ടും എഴുതുക