TLDR Tech / InfoSec
Windows Service
This playbook details six techniques for abusing Windows services to achieve privilege escalation and persistence, including service creation, binary path modification, permission tampering, malicious driver installation, and recovery function abuse. One notable technique exploits Windows service recovery actions to execute arbitrary commands as SYSTEM without modifying the monitored service binary, making it more difficult to detect. The guide includes Sigma rules and a sample KQL query to detect service creation, registry modifications, and recovery function abuse, and recommends proactively identifying Windows services that can be abused through crash-triggered recovery actions.
Read the full story