2026-04-13 08-09-30

0:03

S… Speaker 1 (2026-04-13 08-09-30)

In this video,

0:04

S… Speaker 2 (2026-04-13 08-09-30)

we're going to take a look at how attackers can abuse Windows

0:09

S… Speaker 2 (2026-04-13 08-09-30)

services and also some indicators that can be used to

0:13

S… Speaker 2 (2026-04-13 08-09-30)

search for malicious activity around those Windows services.

0:18

S… Speaker 1 (2026-04-13 08-09-30)

So first of all,

0:19

S… Speaker 2 (2026-04-13 08-09-30)

what exactly is a service?

0:21

S… Speaker 2 (2026-04-13 08-09-30)

Really easy.

0:22

S… Speaker 2 (2026-04-13 08-09-30)

This is just any sort of process that is just running in the background

0:27

S… Speaker 2 (2026-04-13 08-09-30)

of a machine.

0:28

S… Speaker 2 (2026-04-13 08-09-30)

Regular processes that are running in the background are usually going

0:32

S… Speaker 2 (2026-04-13 08-09-30)

to be considered a service.

0:34

S… Speaker 1 (2026-04-13 08-09-30)

Now,

0:35

S… Speaker 2 (2026-04-13 08-09-30)

there's a lot of different ways that you can have your services start.

0:38

S… Speaker 2 (2026-04-13 08-09-30)

You can have your services start on boot when the system boots up or

0:43

S… Speaker 2 (2026-04-13 08-09-30)

when a user logs in.

0:44

S… Speaker 2 (2026-04-13 08-09-30)

This is what's known as an automatic start.

0:46

S… Speaker 2 (2026-04-13 08-09-30)

Or there can be some sort of other trigger.

0:48

S… Speaker 2 (2026-04-13 08-09-30)

This can be manually by a user or typically an administrator

0:53

S… Speaker 2 (2026-04-13 08-09-30)

or some other sort of trigger for that service.

0:56

S… Speaker 2 (2026-04-13 08-09-30)

There's many different options when it comes to launching a service in Windows.

1:01

S… Speaker 2 (2026-04-13 08-09-30)

There's a few different ways that attackers can

1:05

S… Speaker 2 (2026-04-13 08-09-30)

abuse these services,

1:06

S… Speaker 2 (2026-04-13 08-09-30)

and they commonly are going to abuse them for some sort of a persistence

1:11

S… Speaker 2 (2026-04-13 08-09-30)

mechanism.

1:12

S… Speaker 2 (2026-04-13 08-09-30)

This can be a malicious process that they have on the system that they

1:16

S… Speaker 2 (2026-04-13 08-09-30)

want to have starting at boot.

1:18

S… Speaker 2 (2026-04-13 08-09-30)

It can be used to connect to their command and control infrastructure

1:23

S… Speaker 2 (2026-04-13 08-09-30)

so that the system,

1:24

S… Speaker 2 (2026-04-13 08-09-30)

the malware on that system,

1:26

S… Speaker 2 (2026-04-13 08-09-30)

can get additional instructions from whatever that C2 infrastructure is.

1:30

S… Speaker 2 (2026-04-13 08-09-30)

And it can also be used to ensure elevated access on a

1:34

S… Speaker 1 (2026-04-13 08-09-30)

system.

1:35

S… Speaker 2 (2026-04-13 08-09-30)

It can be some repeating process that runs.

1:38

S… Speaker 2 (2026-04-13 08-09-30)

Either when a user logs into the computer or on a regular schedule.

1:42

S… Speaker 2 (2026-04-13 08-09-30)

Usually a regular schedule will be something more like a scheduled task.

1:45

S… Speaker 2 (2026-04-13 08-09-30)

Those can accomplish very similar objectives for an attacker.

1:49

S… Speaker 2 (2026-04-13 08-09-30)

But these are a few reasons that attackers will commonly abuse

1:54

S… Speaker 2 (2026-04-13 08-09-30)

Windows services.

1:56

S… Speaker 2 (2026-04-13 08-09-30)

And there are some ways to be able to identify this and some ways that attackers do

2:00

S… Speaker 1 (2026-04-13 08-09-30)

abuse them.

2:01

S… Speaker 2 (2026-04-13 08-09-30)

Number one is going to be creating a new service.

2:04

S… Speaker 2 (2026-04-13 08-09-30)

And there's several different ways that attackers can do this.

2:08

S… Speaker 2 (2026-04-13 08-09-30)

They can do it with the sc .exe command with the create

2:12

S… Speaker 1 (2026-04-13 08-09-30)

option.

2:12

S… Speaker 2 (2026-04-13 08-09-30)

They can use the PowerShell commandlet new service.

2:16

S… Speaker 2 (2026-04-13 08-09-30)

Or they can run various different WMI commands that can

2:20

S… Speaker 2 (2026-04-13 08-09-30)

be used to create services as well.

2:23

S… Speaker 2 (2026-04-13 08-09-30)

And there are registry modifications specifically to the

2:27

S… Speaker 2 (2026-04-13 08-09-30)

current control set services registry key,

2:31

S… Speaker 2 (2026-04-13 08-09-30)

where the attackers can create new keys in there

2:35

S… Speaker 2 (2026-04-13 08-09-30)

to be able to kind of register services on the

2:39

S… Speaker 1 (2026-04-13 08-09-30)

system.

2:40

S… Speaker 2 (2026-04-13 08-09-30)

And there's various third -party tools that can be used to create malicious

2:44

S… Speaker 1 (2026-04-13 08-09-30)

services.

2:45

S… Speaker 2 (2026-04-13 08-09-30)

Now, keep in mind here that...

2:48

S… Speaker 2 (2026-04-13 08-09-30)

Services themselves are a normal part of really any Windows

2:52

S… Speaker 1 (2026-04-13 08-09-30)

systems.

2:53

S… Speaker 2 (2026-04-13 08-09-30)

They're required for Windows systems to function.

2:55

S… Speaker 2 (2026-04-13 08-09-30)

But they're also used by applications,

2:58

S… Speaker 2 (2026-04-13 08-09-30)

regular legitimate applications as well.

3:00

S… Speaker 2 (2026-04-13 08-09-30)

So new services on a system is a perfectly legitimate thing,

3:05

S… Speaker 2 (2026-04-13 08-09-30)

which is a reason why attackers abuse them,

3:08

S… Speaker 2 (2026-04-13 08-09-30)

because it is a legitimate process.

3:12

S… Speaker 1 (2026-04-13 08-09-30)

They can also,

3:13

S… Speaker 2 (2026-04-13 08-09-30)

in addition to creating new services,

3:15

S… Speaker 2 (2026-04-13 08-09-30)

they can also modify or replace existing

3:19

S… Speaker 1 (2026-04-13 08-09-30)

services.

3:20

S… Speaker 2 (2026-04-13 08-09-30)

Now, this modification does require either the attacker to

3:24

S… Speaker 2 (2026-04-13 08-09-30)

have proper access to the system to be able to modify existing services,

3:29

S… Speaker 2 (2026-04-13 08-09-30)

or for the service to have been

3:33

S… Speaker 2 (2026-04-13 08-09-30)

configured with weak permissions that allows a regular user

3:37

S… Speaker 2 (2026-04-13 08-09-30)

account to be able to modify that service.

3:41

S… Speaker 1 (2026-04-13 08-09-30)

they can essentially,

3:43

S… Speaker 2 (2026-04-13 08-09-30)

there's a couple different things they can do.

3:45

S… Speaker 2 (2026-04-13 08-09-30)

One of the main things they'll do when they're modifying a service is just change what

3:49

S… Speaker 2 (2026-04-13 08-09-30)

executable that service is going to launch.

3:51

S… Speaker 2 (2026-04-13 08-09-30)

Instead of pointing it at whatever legitimate purpose the service was there for,

3:55

S… Speaker 2 (2026-04-13 08-09-30)

they'll point it at the malicious payload that they have on

3:59

S… Speaker 1 (2026-04-13 08-09-30)

the system.

4:00

S… Speaker 2 (2026-04-13 08-09-30)

They can also change the recovery options on a service.

4:05

S… Speaker 2 (2026-04-13 08-09-30)

Recovery options are basically what happens when the

4:09

S… Speaker 2 (2026-04-13 08-09-30)

service stops unexpectedly or fails for whatever reason.

4:13

S… Speaker 2 (2026-04-13 08-09-30)

There are many different options that can be enabled as

4:17

S… Speaker 2 (2026-04-13 08-09-30)

a recovery option for a service,

4:19

S… Speaker 2 (2026-04-13 08-09-30)

and one of those is to launch a program when

4:24

S… Speaker 2 (2026-04-13 08-09-30)

the service fails.

4:26

S… Speaker 2 (2026-04-13 08-09-30)

So that is another thing an attacker can modify on a service

4:30

S… Speaker 2 (2026-04-13 08-09-30)

to be able to...

4:32

S… Speaker 2 (2026-04-13 08-09-30)

kind of use it for malicious intent there.

4:36

S… Speaker 1 (2026-04-13 08-09-30)

Now,

4:37

S… Speaker 2 (2026-04-13 08-09-30)

attackers might,

4:38

S… Speaker 1 (2026-04-13 08-09-30)

a lot of times,

4:39

S… Speaker 2 (2026-04-13 08-09-30)

will try to modify legitimate Windows services.

4:42

S… Speaker 2 (2026-04-13 08-09-30)

Now, there are some protections against that,

4:44

S… Speaker 2 (2026-04-13 08-09-30)

but the key to remember there is just because the name

4:49

S… Speaker 2 (2026-04-13 08-09-30)

of a service is a legitimate Windows service doesn't

4:53

S… Speaker 2 (2026-04-13 08-09-30)

actually mean it should be trusted.

4:55

S… Speaker 2 (2026-04-13 08-09-30)

You always want to verify those.

4:58

S… Speaker 2 (2026-04-13 08-09-30)

There's some ways you can recognize the abuse of Windows services

5:02

S… Speaker 2 (2026-04-13 08-09-30)

and recognize the creation or modification of these malicious

5:07

S… Speaker 1 (2026-04-13 08-09-30)

services.

5:07

S… Speaker 1 (2026-04-13 08-09-30)

Remember,

5:08

S… Speaker 2 (2026-04-13 08-09-30)

any application can create a service as long as it's been given

5:12

S… Speaker 2 (2026-04-13 08-09-30)

the proper access to do that.

5:15

S… Speaker 1 (2026-04-13 08-09-30)

So when we're looking,

5:16

S… Speaker 2 (2026-04-13 08-09-30)

when we're performing our endpoint threat hunts,

5:18

S… Speaker 2 (2026-04-13 08-09-30)

there's several different indicators you can look for for service creation.

5:23

S… Speaker 2 (2026-04-13 08-09-30)

We've looked at these briefly already.

5:25

S… Speaker 2 (2026-04-13 08-09-30)

So you have sc .exe.

5:27

S… Speaker 2 (2026-04-13 08-09-30)

This is a command line program that can be used to manage

5:31

S… Speaker 2 (2026-04-13 08-09-30)

these services.

5:32

S… Speaker 2 (2026-04-13 08-09-30)

So if you see sc .exe create,

5:36

S… Speaker 1 (2026-04-13 08-09-30)

in the logs,

5:38

S… Speaker 2 (2026-04-13 08-09-30)

that is an indication that a service was created.

5:41

S… Speaker 2 (2026-04-13 08-09-30)

Now, whether or not it's malicious or not requires additional context and additional

5:45

S… Speaker 2 (2026-04-13 08-09-30)

analysis and investigation.

5:47

S… Speaker 2 (2026-04-13 08-09-30)

You also have the PowerShell commandlet new service.

5:51

S… Speaker 2 (2026-04-13 08-09-30)

If you see that in the logs,

5:53

S… Speaker 2 (2026-04-13 08-09-30)

it is an indication that a service was created.

5:55

S… Speaker 1 (2026-04-13 08-09-30)

And again,

5:56

S… Speaker 2 (2026-04-13 08-09-30)

if you see reg add,

5:58

S… Speaker 2 (2026-04-13 08-09-30)

the command line utility used to create a new registry key,

6:02

S… Speaker 2 (2026-04-13 08-09-30)

In this registry key,

6:04

S… Speaker 2 (2026-04-13 08-09-30)

it's on screen here,

6:05

S… Speaker 2 (2026-04-13 08-09-30)

the current control set services.

6:07

S… Speaker 2 (2026-04-13 08-09-30)

That is another indicator you can use to search

6:11

S… Speaker 2 (2026-04-13 08-09-30)

during an endpoint threat hunt for a malicious service creation.

6:15

S… Speaker 2 (2026-04-13 08-09-30)

In addition to just the reg add command,

6:20

S… Speaker 2 (2026-04-13 08-09-30)

you can also search for specific event IDs

6:24

S… Speaker 2 (2026-04-13 08-09-30)

tied to Sysmon.

6:25

S… Speaker 2 (2026-04-13 08-09-30)

So event IDs 12,

6:27

S… Speaker 1 (2026-04-13 08-09-30)

13,

6:27

S… Speaker 1 (2026-04-13 08-09-30)

and 14.

6:28

S… Speaker 2 (2026-04-13 08-09-30)

12 is for creating and deleting registry

6:32

S… Speaker 1 (2026-04-13 08-09-30)

entries.

6:33

S… Speaker 2 (2026-04-13 08-09-30)

13 is for setting a value for registry key.

6:37

S… Speaker 2 (2026-04-13 08-09-30)

And 14 is a key or a value being renamed.

6:42

S… Speaker 2 (2026-04-13 08-09-30)

In addition to Sysmon,

6:46

S… Speaker 2 (2026-04-13 08-09-30)

you have some built -in Windows event IDs that are

6:50

S… Speaker 2 (2026-04-13 08-09-30)

associated with new service creation.

6:53

S… Speaker 2 (2026-04-13 08-09-30)

Both 4698 and 7045

6:57

S… Speaker 2 (2026-04-13 08-09-30)

can be used as indicators to determine when

7:01

S… Speaker 2 (2026-04-13 08-09-30)

a new service has been created on a system.

7:05

S… Speaker 2 (2026-04-13 08-09-30)

Essentially,

7:05

S… Speaker 2 (2026-04-13 08-09-30)

both of those event IDs are the exact same thing.

7:08

S… Speaker 2 (2026-04-13 08-09-30)

They are for a new service was installed on the system.

7:12

S… Speaker 2 (2026-04-13 08-09-30)

So a number of different indicators that can be used

7:16

S… Speaker 2 (2026-04-13 08-09-30)

to find when services have been created that

7:21

S… Speaker 2 (2026-04-13 08-09-30)

will be in various different locations in logs,

7:23

S… Speaker 2 (2026-04-13 08-09-30)

depending on what you're looking for and what the logging capabilities of that system

7:28

S… Speaker 1 (2026-04-13 08-09-30)

were.

7:29

S… Speaker 1 (2026-04-13 08-09-30)

Also,

7:30

S… Speaker 2 (2026-04-13 08-09-30)

something you want to keep an eye out for is any sort of unrecognized user

7:34

S… Speaker 2 (2026-04-13 08-09-30)

or unauthorized user.

7:36

S… Speaker 2 (2026-04-13 08-09-30)

Just because the account that's creating it has the permissions

7:40

S… Speaker 2 (2026-04-13 08-09-30)

to create a service on a system doesn't necessarily

7:45

S… Speaker 2 (2026-04-13 08-09-30)

mean that they are authorized to create that service.

7:49

S… Speaker 2 (2026-04-13 08-09-30)

Keep that distinction in mind there.

7:52

S… Speaker 2 (2026-04-13 08-09-30)

So looking for any unauthorized or unrecognized accounts that are

7:56

S… Speaker 2 (2026-04-13 08-09-30)

either creating or modifying services is a really good

8:00

S… Speaker 2 (2026-04-13 08-09-30)

indicator you can search for for any sort of malicious activity

8:04

S… Speaker 2 (2026-04-13 08-09-30)

around services also.

8:06

S… Speaker 2 (2026-04-13 08-09-30)

So Windows services are very commonly abused by attackers,

8:09

S… Speaker 2 (2026-04-13 08-09-30)

typically for persistence mechanisms again.

8:12

S… Speaker 2 (2026-04-13 08-09-30)

So definitely something you want to keep in mind when

8:17

S… Speaker 2 (2026-04-13 08-09-30)

you're performing your endpoint threat hunts.

2026-04-13 08-09-30

Samenvatting

Vraag AI over dit Transcript