CmdID

CmdID / Techniques / T1569

T1569.002 System Services: Service Execution

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. MITRE ATT&CK

9 Sigma rules T1569.002 on attack.mitre.org

Part of

MITRE ATT&CK
T1569System Services

Sigma rules tagged with it

process creation, the highest levels first
criticalDNS RCE CVE-2020-1350Florian Roth (Nextron Systems) · Windows
criticalHackTool - SharpUp PrivEsc Tool ExecutionFlorian Roth (Nextron Systems) · Windows
highPUA - CsExec ExecutionFlorian Roth (Nextron Systems) · Windows
highPUA - NirCmd Execution As LOCAL SYSTEMFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highPUA - NSudo ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali · Windows
highPUA - RunXCmd ExecutionFlorian Roth (Nextron Systems) · Windows
highRundll32 Execution Without ParametersBartlomiej Czyz, Relativity · Windows
mediumPUA - NirCmd ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
lowStart Windows Service Via Net.EXETimur Zinniatullin, Daniil Yugoslavskiy, oscd.community · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Start or stop a Windows service synchronously on the page for net

net start serviceIdentify

An example is here when CmdID’s reading of it names T1569.002: a Sigma rule it trips is tagged with it, or its abuse is documented as it.