Services Registry Permissions Weakness

ATT&CK T1574.011

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under <code>HKLM\SYSTEM\CurrentControlSet\Services</code>. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller,

Category: Technique, stealth, execution

MITRE ATT&CK: T1574.011

Reference: MITRE ATT&CK T1574.011