value:  AuditCred is installed as a new service on the system. ;; Bankshot can terminate a specific process by its process id. ;; BBSRAT can modify service configurations. ;; BitPaymer has attempted to install itself as a service to maintain persistence. ;; One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name. ;; Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service. ;; Briba installs a service pointing to a malicious DLL dropped to disk. ;; Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges. ;; Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine. ;; Catchamas adds a new service named NetAdapter to establish persistence. ;; Cobalt Group has created new services to establish persistence. ;; Cobalt Strike can install a new service. ;; CosmicDuke uses Windows services typically named javamtsup" for persistence. ;; One persistence mechanism used by CozyCar is to register itself as a Windows service. ;; DarkVishnya created new services for shellcode loaders distribution. ;; Dtrack can add a service called WBService to establish persistence. ;; Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active the operating system believes that the driver is legitimate as it has been signed with a valid private key. ;; Dyre registers itself as a service by adding several Registry keys. ;; Elise configures itself as a service. ;; Emissary is capable of configuring itself as a service. ;; Emotet has been observed creating new services to maintain persistence.  ;; Empire can utilize built-in modules to modify service binaries and restore them to their original state. ;; The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV.” ;; FALLCHILL has been installed as a Windows service. ;; FIN7 created new Windows services and added them to the startup directories for persistence. ;; FinFisher creates a new Windows service with the malicious executable for persistence. ;; gh0st RAT can create a new service to establish persistence. ;; GoldenSpy has established persistence by running in the background as an autostart service. ;; GreyEnergy chooses a service drops a DLL file and writes it to that serviceDLL Registry key. ;; hcdLoader installs itself as a service for persistence. ;; Honeybee has batch files that modify the system service COMSysApp to load a malicious DLL. ;; Hydraq creates new services to establish persistence. ;; Some InnaputRAT variants create a new Windows service to establish persistence. ;; InvisiMole can register a Windows service named CsPower as part of its execution chain and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence. ;; JHUHUGIT has registered itself as a service to establish persistence. ;; Kazuar can install itself as a new service. ;; Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent. ;; KeyBoy installs a service pointing to a malicious DLL dropped to disk. ;; Kimsuky has created new services for persistence. ;; Kwampirs creates a new service named WmiApSrvEx to establish persistence. ;; Several Lazarus Group malware families install themselves as new services on victims. ;; LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file. ;; MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not it will spawn a new instance. ;; Naid creates a new service to establish. ;; Nerex creates a Registry subkey that registers a new service. ;; Nidiran can create a new service named msamger (Microsoft Security Accounts Manager). ;; To establish persistence Okrum can install itself as a new service named NtmSsvc. ;; PipeMon can establish persistence by registering a malicious DLL as an alternative Print Processor which is loaded when the print spooler service starts. ;; PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start control and delete services. ;; PoisonIvy creates a Registry subkey that registers a new service. PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk. ;; PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries paths and configs. ;; PROMETHIUM has created new services and modified existing services for persistence. ;; Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver. ;; RawPOS installs itself as a service to maintain persistence. ;; RDAT has created a service when it is installed on the victim machine. ;; Reaver installs itself as a new service. ;; Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument. ;; Seasalt is capable of installing itself as a service. ;; Shamoon creates a new service named “ntssrv” to execute the payload. Newer versions create the "MaintenaceSrv" and "hdv_725x" services. ;; ShimRat has installed a Windows service to maintain persistence on victim machines. ;; SLOTHFULMEDIA has created a service on victim machines named "TaskFrame" to establish persistence. ;; StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start. ;; StrongPity has created new services and modified existing services for persistence. ;; If running as administrator TDTESS installs itself as a new service named bmwappushservice to establish persistence. ;; TEARDROP ran as a Windows service from the c:\windows\syswow64 folder. ;; A Threat Group-3390 tool can create a new service naming it after the config information to gain persistence. ;; TinyZBot can install as a Windows service for persistence. ;; TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots. ;; Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk. ;; TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine. ;; Ursnif has registered itself as a system service in the Registry for automatic execution at system startup. ;; Volgmer installs a copy of itself in a randomly selected service then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings. ;; WannaCry creates the service "mssecsvc2.0" with the display name "Microsoft Security Center (2.0) Service." ;; Wiarp creates a backdoor through which remote attackers can create a service. ;; Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file. ;; Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence. ;; Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence. ;; ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system. ;; ZLib creates Registry keys to allow itself to run as various services. ;; zwShell has established persistence by adding itself as a new service. ;; ZxShell can create a new service using the service parser function ProcessScCommand. "
name: Create or Modify System Process: Windows Service