Skip to content
Threat Feed
Subscribe

Product

SCCM

3 briefs RSS
high advisory

Windows Service Installed via an Unusual Client for Privilege Escalation

Identifies the creation of a Windows service by an unusual client process, which can be leveraged to escalate privileges from administrator to SYSTEM by exploiting misconfigurations or vulnerabilities in the service creation process.

VeeamVssSupport +6 privilege-escalation windows-service windows
2r 1t
medium advisory

WMI Incoming Lateral Movement

Detection of processes executed via Windows Management Instrumentation (WMI) on a remote host indicating potential adversary lateral movement.

HPWBEM +3 lateral-movement wmi windows
3r 2t
medium advisory

Remote Execution of Windows Services via RPC

Detection of remote execution of Windows services over RPC by correlating `services.exe` network connections and spawned child processes, potentially indicating lateral movement.

SCCM lateral-movement execution windows
2r 2t