{"id":"T1569","name":"System Services","url":"https://attack.mitre.org/techniques/T1569","tactics":["execution"],"platforms":["Windows","macOS","Linux"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0279","stix_id":"x-mitre-detection-strategy--38364d2d-7b25-4f75-9679-eca4dd18b213","name":"Detection Strategy for System Services across OS platforms.","url":"https://attack.mitre.org/detectionstrategies/DET0279","analytics":[{"id":"AN0778","stix_id":"x-mitre-analytic--667c21d2-2f92-42d6-aaea-b46974f63c8d","name":"Analytic 0778","description":"Monitor for abnormal creation or modification of Windows services (e.g., via sc.exe, PowerShell, or API calls) that load non-standard executables. Correlate registry changes in service keys with service creation events and process execution to detect service abuse for persistence or execution.","url":"https://attack.mitre.org/detectionstrategies/DET0279#AN0778","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4697","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ServiceAllowlist","description":"Known good services and installers that regularly modify or create services"},{"field":"TimeWindow","description":"Threshold for correlating service creation with unusual process execution"}],"live":true,"detection_strategies":["DET0279"],"techniques":["T1569"]},{"id":"AN0779","stix_id":"x-mitre-analytic--65691cb3-a2b3-4c48-91d2-7088a047ebef","name":"Analytic 0779","description":"Detect unusual invocations of systemctl, service, or init scripts creating or modifying daemons. Monitor audit logs for execution of binaries from unexpected paths linked to service start/stop activity.","url":"https://attack.mitre.org/detectionstrategies/DET0279#AN0779","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"systemctl start/enable with uncommon binary paths","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"linux-syslog"},{"name":"auditd:SYSCALL","channel":"write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ServiceBinaryPaths","description":"Valid directories for service binaries to filter out benign changes"},{"field":"UserContext","description":"Expected accounts performing service management (e.g., root/admin)"}],"live":true,"detection_strategies":["DET0279"],"techniques":["T1569"]},{"id":"AN0780","stix_id":"x-mitre-analytic--63d21290-b858-4c4e-9447-31d623048048","name":"Analytic 0780","description":"Monitor launchd service definitions and property list (.plist) modifications for non-standard executables. Detect unauthorized processes registered as launch daemons or agents.","url":"https://attack.mitre.org/detectionstrategies/DET0279#AN0780","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Unexpected processes registered with launchd","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Modification of LaunchAgents or LaunchDaemons plist files","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"PlistAllowlist","description":"Known launch agents/daemons expected to be modified by updates or IT tools"},{"field":"PayloadEntropyThreshold","description":"Entropy level for detecting suspicious binary payloads in launchd services"}],"live":true,"detection_strategies":["DET0279"],"techniques":["T1569"]}],"live":true,"version":"1.0","techniques":["T1569"]}],"sigma_rules":[{"id":"4e64668a-4da1-49f5-a8df-9e2d5b866718","title":"Possible CVE-2021-1675 Print Spooler Exploitation","author":"Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w, Tim Shelton","status":"test","level":"high","date":"2021-06-30","modified":"2022-11-15","description":"Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675","references":["https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/","https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare","https://twitter.com/fuzzyf10w/status/1410202370835898371"],"logsource":{"product":"windows","service":"printservice-admin"},"tags":["attack.execution","attack.t1569","cve.2021-1675","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-1675/win_exploit_cve_2021_1675_printspooler.yml","techniques":["T1569"],"cves":["CVE-2021-1675"]},{"id":"730fc21b-eaff-474b-ad23-90fd265d4988","title":"Psexec Execution","author":"omkar72","status":"test","level":"medium","date":"2020-10-30","modified":"2023-02-28","description":"Detects user accept agreement execution in psexec commandline","references":["https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.lateral-movement","attack.t1569","attack.t1021"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_psexec_execution.yml","techniques":["T1569","T1021"],"cves":[]},{"id":"8fe1c584-ee61-444b-be21-e9054b229694","title":"CVE-2021-1675 Print Spooler Exploitation IPC Access","author":"INIT_6","status":"test","level":"critical","date":"2021-07-02","modified":"2022-10-05","description":"Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527","references":["https://twitter.com/INIT_3/status/1410662463641731075"],"logsource":{"product":"windows","service":"security"},"tags":["attack.execution","attack.t1569","cve.2021-1675","cve.2021-34527","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-1675/win_security_exploit_cve_2021_1675_printspooler_security.yml","techniques":["T1569"],"cves":["CVE-2021-1675","CVE-2021-34527"]},{"id":"f34d942d-c8c4-4f1f-b196-22471aecf10a","title":"CVE-2021-1675 Print Spooler Exploitation","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-07-01","modified":"2022-10-09","description":"Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675","references":["https://twitter.com/MalwareJake/status/1410421967463731200"],"logsource":{"product":"windows","service":"printservice-operational"},"tags":["attack.execution","attack.t1569","cve.2021-1675","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-1675/win_exploit_cve_2021_1675_printspooler_operational.yml","techniques":["T1569"],"cves":["CVE-2021-1675"]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}