Home > CAPEC List > CAPEC-550: Install New Service (Version 2.10)  

CAPEC-550: Install New Service

 
Install New Service
Definition in a New Window Definition in a New Window
Attack Pattern ID: 550
Abstraction: Detailed
Status: Draft
Completeness: Stub
Presentation Filter:
+ Summary

When an operating system starts, it also starts programs called services or daemons. Adversaries may install a new service which will be executed at startup (on a Windows system, by modifying the registry). The service name may be disguised by using a name from a related operating system or benign software. Services are usually run with elevated privileges.

+ Solutions and Mitigations

Limit privileges of user accounts so new service creation can only be performed by authorized administrators.

+ References
[R.550.1] ATT&CK Project. "New Service (T1050)". MITRE. <https://attack.mitre.org/wiki/Technique/T1050>.
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2015-11-09Internal_CAPEC_Team
Modifications
ModifierOrganizationDateCommentsSource
CAPEC Content TeamThe MITRE Corporation2017-05-01Updated ReferencesInternal
More information is available — Please select a different filter.
Page Last Updated or Reviewed: May 01, 2017