Service Modification (66531bc6-a509-4868-8314-4d599e91d222)
Changes made to an existing service or daemon, such as modifying the service name, start type, execution parameters, or security configurations.
*Data Collection Measures: *
- Windows Event Logs
- Event ID 7040 - Detects modifications to the startup behavior of a service.
- Event ID 7045 - Can capture changes made to existing services.
- Event ID 7036 - Tracks when services start or stop, potentially indicating malicious tampering.
- Event ID 4697 - Can detect when an adversary reinstalls a service with different parameters.
- Sysmon Logs
- Sysmon Event ID 13 - Detects changes to service configurations in the Windows Registry (e.g.,
HKLM\SYSTEM\CurrentControlSet\Services\). - Sysmon Event ID 1 - Can track execution of
sc.exeorPowerShell Set-Service.
- Sysmon Event ID 13 - Detects changes to service configurations in the Windows Registry (e.g.,
- PowerShell Logging
- Event ID 4104 (Script Block Logging) - Captures execution of commands like
Set-Service,New-Service, orsc config. - Command-Line Logging (Event ID 4688) - Tracks usage of service modification commands:
sc config <service_name> start= autosc qc <service_name>
- Event ID 4104 (Script Block Logging) - Captures execution of commands like
- Linux/macOS Collection Methods
- Systemd Journals (
journalctl -u <service_name>) Tracks modifications to systemd service configurations. - Daemon Logs (
/var/log/syslog,/var/log/messages,/var/log/daemon.log) Captures changes to service state and execution parameters. - AuditD Rules for Service Modification
- Monitor modifications to
/etc/systemd/system/for new or altered service unit files:auditctl -w /etc/systemd/system/ -p wa -k service_modification - Track execution of
systemctlorservicecommands:auditctl -a always,exit -F arch=b64 -S execve -F a0=systemctl -F key=service_mod
- Monitor modifications to
- OSQuery for Linux/macOS Monitoring
- Query modified services using OSQuery’s
processesorsystem_infotables:SELECT * FROM systemd_units WHERE state != 'running';
- Query modified services using OSQuery’s
- macOS Launch Daemon/Agent Modification
- Monitor for changes in:
/Library/LaunchDaemons//Library/LaunchAgents/
- Track modifications to
.plistfiles indicating persistence attempts.
- Monitor for changes in:
- Systemd Journals (