CAPEC-478: Modification of Windows Service Configuration
An adversary exploits a weakness in access control to modify the execution parameters of a Windows service. The goal of this attack is to execute a malicious binary in place of an existing service.
Last updated
Overview
CAPEC-478 (Modification of Windows Service Configuration) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Explore
[Determine target system] The adversary must first determine the system they wish to modify the registry of. This needs to be a windows machine as this attack only works on the windows registry.
- Step 2Experiment
[Gain access to the system] The adversary needs to gain access to the system in some way so that they can modify the windows registry.
- Gain physical access to a system either through shoulder surfing a password or accessing a system that is left unlocked.
- Gain remote access to a system through a variety of means.
- Step 3Exploit
[Modify windows registry] The adversary will modify the windows registry by changing the configuration settings for a service. Specifically, the adversary will change the path settings to define a path to a malicious binary to be executed.