Techniques › T1569.002 › AN1185
AN1185 Analytic 1185
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection focuses on abnormal service executions initiated via service control manager APIs, sc.exe, net.exe, or PsExec creating temporary services. Defenders observe process creation of services.exe spawning non-standard binaries, registry changes in service keys followed by rapid execution, and network connections originating from processes tied to transient services. Correlation across process lineage, registry activity, and service logs provides strong signals of malicious service execution.</p>
- Detects
- T1569.002 Service Execution
- Part of
- DET0421 Detection Strategy for System Services Service Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4697 | DC0060 Service Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ServiceBinaryAllowlist | Known binaries/services expected to be invoked via services.exe |
ParentProcessCorrelationWindow | Time window for correlating service creation with execution events |
RemoteExecutionHosts | Approved remote hosts that may trigger service execution (e.g., via PsExec) |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2021-35394 | Realtek Jungle Software Development Kit (SDK) | Mapped |