value:  Chimera has used PsExec to deploy beacons on compromised systems. ;; Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services. ;; Empire can use PsExec to execute a payload on a remote host. ;; FIN6 has created Windows services to execute encoded PowerShell commands. ;; gh0st RAT can execute its service if the Service key exists. If the key does not exist gh0st RAT will create and run the service. ;; Honeybee launches a DLL file that gets executed as a service using svchost.exe ;; HOPLIGHT has used svchost.exe to execute a malicious DLL . ;; Hydraq uses svchost.exe to execute a malicious DLL included in a new service group. ;; HyperBro has the ability to start and stop a specified service. ;; Impacket contains various modules emulating other service execution tools such as PsExec. ;; InvisiMole has used Windows services as a way to execute its malicious payload. ;; Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries. ;; Koadic can run a command on another machine using PsExec. ;; LoudMiner started the cryptomining virtual machine as a service on the infected machine. ;; The net start and net stop commands can be used in Net to execute or stop Windows services. ;; Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement. ;; Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload. ;; NotPetya can use PsExec to help propagate itself across a network. ;; Okrum's loader can create a new service named NtmsSvc to execute the payload. ;; Olympic Destroyer utilizes PsExec to help propagate itself across a network. ;; Operation Wocao has created services on remote systems for execution purposes. ;; PoshC2 contains an implementation of PsExec for remote execution. ;; Proxysvc registers itself as a service on the victim’s machine to run as a standalone process. ;; Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service. ;; Pupy uses PsExec to execute a payload or commands on a remote host. ;; Pysa has used PsExec to copy and execute the ransomware. ;; Ragnar Locker has used sc.exe to execute a service that it creates. ;; RemoteCMD can execute commands remotely by creating a new service on the remote system. ;; Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec. ;; Silence has used Winexe to install a service on the remote system. ;; SLOTHFULMEDIA has the capability to start services. ;; StrongPity can install a service to execute itself as a service. ;; Winexe installs a service on the remote system executes the command then uninstalls the service. ;; Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file. ;; Wizard Spider has used services.exe to execute scripts and executables during lateral movement within a victim network. ;; xCmd can be used to execute binaries on remote systems by creating and starting a service."
name: System Services: Service Execution