CAPEC-478: Modification of Windows Service Configuration

MITRE CAPEC attack pattern

Description

An adversary exploits a weakness in access control to modify the execution parameters of a Windows service. The goal of this attack is to execute a malicious binary in place of an existing service.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-284

ATT&CK techniques: T1543.003, T1574.011

Prerequisites

• The adversary must have the capability to write to the Windows Registry on the targeted system.

Consequences

• Integrity: Execute Unauthorized Commands

Mitigations

• Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.

Source

• MITRE CAPEC CAPEC-478