Windows Service

ATT&CK T1543.003

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using syste

Category: Technique, persistence, privilege-escalation

MITRE ATT&CK: T1543.003

Reference: MITRE ATT&CK T1543.003