Services

Overview

• Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

This key stores a wide array of information, including the service's display name, its executable path, start-up type, and other configuration details necessary for its operation. Each subkey under the Services key represents a single service.

Legitimate Uses

Services are used by both Windows and third-party applications to perform various tasks that require background processing, event logging, or need to start before the user logs in. For example:

• System Services: Critical for the operation of the operating system, such as Dhcp (Dynamic Host Configuration Protocol), which is used to dynamically assign IP addresses to devices on a network.

• Third-party Services: Installed by applications that require constant running or need to start automatically, like antivirus software services.

Abuse by Threat Actors

Threat actors can abuse the Services key in several ways to establish persistence, elevate privileges, or execute malicious payloads:

• Creating Malicious Services: By creating a new subkey under the Services key, attackers can register their own malicious service to start automatically with the system.

• Modifying Existing Services: Altering the configuration of existing services, such as changing the executable path (ImagePath) to point to a malicious executable, can allow malware to execute under the guise of a legitimate service.

• Service DLL Hijacking: Some services load external DLLs during their operation. If a service is configured to load a DLL insecurely, attackers can place a malicious DLL in the expected path, leading to the execution of malicious code.

Examples of Suspicious Entries

• Creating Malicious Services: A suspicious service entry might be one that does not correspond to any known software installed on the system, especially if it's configured to automatically start and run an executable from an unusual location:

  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RandomServiceName]
  "DisplayName"="Suspicious Service"
  "ImagePath"="C:\\Users\\Public\\malware.exe"
  "Start"=dword:00000002

• Modifying Existing Services: A modification to an existing service to run a different executable could be indicative of tampering:

  "ImagePath"="C:\\Windows\\system32\\legitservice.exe -k C:\\Windows\\Temp\\malware.exe"

• Service DLL Hijacking: A legitimate service altered to load a malicious DLL could look like this (assuming the service is vulnerable to DLL hijacking):

  "ServiceDLL"="C:\Users\Public\malicious.dll"

Detection and Analysis

Detecting unauthorized modifications within the Services key involves monitoring for new services being created, existing services being modified, or unusual configurations. Security professionals use tools like sc query, PowerShell scripts, or third-party utilities to enumerate services and their configurations for auditing and analysis. Endpoint detection and response (EDR) solutions and Windows Event Logs are also crucial for monitoring service-related activities.

It is essential to verify the legitimacy of services and their configurations. Suspicious indicators include services with:

• Executable paths pointing to unusual or temporary directories.

• Newly created services that are not associated with any installed software.

• Modified service paths that include additional, unknown executables or scripts.

In summary, while the HKLM\SYSTEM\CurrentControlSet\Services registry key is fundamental for managing Windows services, its misuse by threat actors can serve as a stealthy method for achieving persistence and executing malicious code. Vigilance and regular auditing of this key are vital for maintaining system security and integrity.