CmdID

CmdID / Techniques / T1574

T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. MITRE ATT&CK

2 programs on CmdID 7 Sigma rules T1574.011 on attack.mitre.org

Part of

MITRE ATT&CK

T1574Hijack Execution Flow

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

reg.exeits Sigma rules sc.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highAbuse of Service Permissions to Hide Services Via Set-ServiceNasreddine Bencherchali (Nextron Systems) · Windows

highPossible Privilege Escalation via Weak Service PermissionsTeymur Kheirkhabarov · Windows

highPotential Privilege Escalation via Service Permissions WeaknessTeymur Kheirkhabarov · Windows

highService DACL Abuse To Hide Services Via Sc.EXEAndreas Hunkeler (@Karneades) · Windows

mediumChanging Existing Service ImagePath Value Via Reg.EXEfrack113 · Windows

mediumPotential Persistence Attempt Via Existing Service TamperingSreeman · Windows

mediumService Security Descriptor Tampering Via Sc.EXENasreddine Bencherchali (Nextron Systems) · Windows