Windows Service Creation via Registry Persistence

This detection identifies unauthorized modifications to Windows registry keys located within the 'SYSTEM\CurrentControlSet\Services' path, specifically targeting the 'ImagePath' value. By manipulating this registry entry, an attacker can define or modify the executable path for a service, forcing the system to run malicious payloads upon service start. This technique is a well-documented method for achieving persistence, escalating privileges, and facilitating lateral movement.

This activity is observed across numerous threat campaigns, including those attributed to the SolarWinds WHD RCE exploitation, the use of PlugX and Derusbi backdoors, and recent activity identified as Salt Typhoon. Defenders should monitor registry modifications involving the 'Services' registry hive as a high-fidelity indicator of potential system compromise and unauthorized configuration changes.

Attack Chain

1. Attacker gains initial access to the target endpoint via exploitation or credential theft.
2. Attacker identifies a legitimate Windows service or creates a new service entry.
3. Attacker uses command-line tools like reg.exe or APIs to write a malicious path to the 'ImagePath' registry key.
4. The malicious binary is placed on the local disk or accessed via a remote share.
5. The Windows Service Control Manager (SCM) reads the modified 'ImagePath' upon service initiation or system reboot.
6. The SCM executes the malicious file with SYSTEM or high-privilege credentials.
7. The attacker establishes persistent execution and triggers further malicious activity such as lateral movement or data exfiltration.

Impact

Successful abuse of service registry keys allows attackers to establish long-term persistence on a target host. This can lead to full system compromise, the execution of arbitrary code with SYSTEM privileges, and a foothold that facilitates lateral movement across the internal network. This technique has been linked to data theft, ransomware deployment, and long-term espionage activities.

Recommendation

Prioritize monitoring for registry modifications that target the 'SYSTEM\CurrentControlSet\Services' key, specifically those involving the 'ImagePath' value name.

• Deploy the provided Sigma rule to your SIEM to monitor for Registry Event ID 13 (Sysmon) or equivalent registry modification logs.
• Baseline legitimate software installers and system updates that create or modify services to reduce false positives.
• Investigate any modifications to the 'Services' registry key occurring from non-standard processes, especially those originating from user-space applications or web servers.