T1569No distinct observable

System Services

ExecutionWindows, macOS, Linux

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Every analytic in DET0279 is a child's mechanism, not a parent-level observable. AN0778 (Windows: Security 4697 service creation with a non-standard ServiceFileName, correlated with registry keys 13/14) is exactly T1569.002's mechanism, already published in this corpus as the service-creation rule keyed on ServiceFileName. AN0779 (Linux: systemctl/service invocation with uncommon binary paths) is T1569.003 (Systemctl), whose own brief exists in this corpus under that ID. AN0780 (macOS: launchd/plist modification) is T1569.001 (Launchctl), whose own brief also exists here. No analytic describes behaviour that spans the three mechanisms or sits above them — this is the same shape as the T1053 example in declined-schema.md.

Covered instead by T1569.001, T1569.002, T1569.003.

What the technique is

Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence (Create or Modify System Process), but adversaries can also abuse services for one-time or temporary execution.

Read it on attack.mitre.org

What MITRE says you would watch

AN0778
Monitor for abnormal creation or modification of Windows services (e.g., via sc.exe, PowerShell, or API calls) that load non-standard executables. Correlate registry changes in service keys with service creation events and process execution to detect service abuse for persistence or execution.
AN0779
Detect unusual invocations of systemctl, service, or init scripts creating or modifying daemons. Monitor audit logs for execution of binaries from unexpected paths linked to service start/stop activity.
AN0780
Monitor launchd service definitions and property list (.plist) modifications for non-standard executables. Detect unauthorized processes registered as launch daemons or agents.