Skip to content
Threat Feed
Subscribe
high advisory

Detection of Windows Service Binaries in Suspicious Directories

Adversaries often achieve persistence by registering malicious Windows services with binaries located in writeable or temp directories to evade detection.

Persistence mechanisms on Windows often involve the registration of new services that execute arbitrary binaries. To avoid detection, attackers frequently place these malicious service binaries in directories that are commonly writeable by users or are used for temporary storage, such as \Users\Public, \Perflogs, or \Temp. This technique allows for the execution of malicious payloads with high privileges once the service is started. Security teams should monitor modifications to the HKLM\System\CurrentControlSet\Services registry hive, specifically focusing on the ImagePath and Start values, to identify when services are configured to execute binaries from non-standard or suspicious file paths.

Impact

Successful exploitation of this technique allows attackers to gain persistence, execute arbitrary code with SYSTEM privileges, and potentially impair security controls. This is a common TTP observed across various intrusion campaigns targeting Windows endpoints.

Recommendation

Detection engineering teams should monitor registry modifications to identify unauthorized service creation.

  • Deploy the Sigma rule below to detect service registration pointing to suspicious directories.
  • Review registry events for modifications to HKLM\System\CurrentControlSet\Services.
  • Investigate any service binary path that resides outside of standard system directories like C:\Windows\System32 or C:\Program Files.

Immediate actions

Deploy the provided Sigma rule to detect service registration in suspicious paths.

Detection Engineering 48h

Mitigations

Restrict write permissions for non-admin users to Temp, Public, and Perflogs directories.

medium_term IT Operations

Detection coverage 1

Detect Service Binary in Suspicious Folder via Registry

high

Detects the creation or modification of a Windows service where the binary path resides in a suspicious directory, often used for persistence.

sigma tactics: defense-impairment, persistence techniques: T1112 sources: registry_set, windows

Detection queries are available on the platform. Get full rules →