CmdID

CmdID / Techniques

T1569 System Services

Adversaries may abuse system services or daemons to execute commands or programs. MITRE ATT&CK

1 Sigma rule T1569 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1569.001System Services: Launchctl
T1569.002System Services: Service Execution

Sigma rules tagged with it

process creation, the highest levels first
mediumPsexec Executionomkar72 · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Execute a command using cmd in a remote shell on the page for psexec

psexec \\remote_host cmdIdentify

Execute a command on a remote host (pre-authenticated) on the page for psexec

psexec \\remote_host -u user_name -p passwordIdentify

Execute a command remotely and output the result to a file on the page for psexec

psexec \\remote_host cmd /c command -an ^>path\to\file.txtIdentify

Execute a program to interact with users on the page for psexec

psexec \\remote_host -d -i program_nameIdentify

Display the IP configuration of the remote host on the page for psexec

psexec \\remote_host ipconfig /allIdentify

An example is here when CmdID’s reading of it names T1569: a Sigma rule it trips is tagged with it, or its abuse is documented as it.