mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
009ae77217
* E/f updates (#143) * E/F Update, Update Install Cert ID * Small fixes * Update common objects link (#142) * Update README.md * Update 09152023.md * Update README.md * Update 12182023.md * Adding descriptions to micro-behaviors * Fixing dead links * V3.1 updates (#144) * minor fixes for v3.1 * correct id --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
1.5 KiB
1.5 KiB
| ID | E1569 |
| Objective(s) | Execution |
| Related ATT&CK Techniques | System Services (T1569) |
| Version | 2.0 |
| Created | 8 November 2021 |
| Last Modified | 12 June 2023 |
System Services
Malware may manipulate, create, or interact with system services to achieve persistence, gain higher privileges, or execute malicious code. System services are background processes that are integral parts of an operating system's functionality. Malware can exploit these services by modifying their configurations, replacing legitimate service binaries with malicious ones, or creating new services that run malicious code.
See ATT&CK: System Services (T1569).
Methods
| Name | ID | Description |
|---|---|---|
| MSDTC | E1569.m01 | The Distributed Transaction Coordinator (MSDTC) coordinates transaction across multiple resource managers (databases, message queues and file systems). This legitimate Microsoft service is part of Windows 2000 and later and can be used to import and load DLLs. Malware may abuse MSDTC to import and load DLLs.[1] |
References
[1] https://cyware.com/news/catb-ransomware-exploits-msdtc-service-to-steal-data-3bb46fc0