CyberStack

MITRE ATT&CK / Techniques / T1569.002

System Services: Service Execution

ID
T1569.002
Tactics
TA0002 Execution
Sub-technique of
T1569 System Services
Platforms
Windows
Data sources
Service Creation, Process Creation, Windows Registry Key Modification, Network Connection Creation
Source
attack.mitre.org
MITRE last modified
12 Sep 2026

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.[2] The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net.

PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.[3] Tools such as PsExec and sc.exe can accept remote servers as arguments and may be used to conduct remote execution.

Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation.

Detection

Mitigations (3)

M1022 Restrict File and Directory Permissions

Ensure that high permission level service binaries cannot be replaced or modified by users with a lower permission level.

M1026 Privileged Account Management

Ensure that permissions disallow services that run at a higher permissions level from being created or interacted with by a user with a lower permission level.

M1040 Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by PsExec from running. [1]

Groups (16)

Software (53)

References

  1. win10_asr
  2. Microsoft Service Control Manager
  3. Russinovich Sysinternals