MBCProject-mbc-markdown/persistence/modify-service.md

ID	F0011
Objective(s)	Persistence, Privilege Escalation
Related ATT&CK Sub-Technique	Create or Modify System Process::Windows Service

Modify Existing Service

Malware may modify an existing service to gain persistence. Modification may include disabling a service.

See ATT&CK: Create or Modify System Process::Windows Service.

Malware Examples

Name	Date	Description
Poison-Ivy	2005	After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [1]

References

[1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy