DET0421 Detection Strategy for System Services Service Execution

Technique Detected: T1569.002 (Service Execution)

Analytics

Windows

AN1185

Detection focuses on abnormal service executions initiated via service control manager APIs, sc.exe, net.exe, or PsExec creating temporary services. Defenders observe process creation of services.exe spawning non-standard binaries, registry changes in service keys followed by rapid execution, and network connections originating from processes tied to transient services. Correlation across process lineage, registry activity, and service logs provides strong signals of malicious service execution.

Log Sources

Mutable Elements