Services File Permissions Weakness
Services File Permissions Weakness [T1574.010]
Information
Name: Services File Permissions Weakness
ID: T1574.010
Technique: T1574
Introduction
The MITRE ATT&CK sub-technique "Services File Permissions Weakness" (T1574.010) falls under the broader technique category "Hijack Execution Flow" (T1574). This sub-technique specifically involves exploiting weak or misconfigured file permissions associated with system services to escalate privileges, execute unauthorized commands, or maintain persistence within compromised environments. Attackers leverage these permission weaknesses to modify or replace service executables or configuration files, allowing them to gain elevated privileges or execute malicious code under the context of high-privileged accounts.
Deep Dive Into Technique
Attackers commonly exploit this sub-technique by identifying services running with weak file permissions. These permissions allow unauthorized users or processes to modify, overwrite, or replace critical service files, including executables (.exe), dynamic link libraries (.dll), or configuration files. The attacker typically follows these steps:
Discovery of Weak Permissions:
Enumerate running services using built-in Windows tools (e.g.,
sc,services.msc, or PowerShell cmdlets likeGet-Service).Identify file paths associated with services using commands such as
sc qc <service_name>to query service configurations.Utilize command-line utilities (e.g.,
icacls,cacls,AccessChk) to check file permissions on executables or configuration files.
Exploiting Weak Permissions:
Identify files or directories that allow write or modify permissions to unauthorized users or groups.
Replace legitimate executables or DLL files with malicious payloads.
Modify configuration files to redirect execution flow to attacker-controlled binaries or scripts.
Triggering Malicious Payload Execution:
Restart or trigger the targeted service to execute the malicious payload under the service's security context.
Exploit service restarts during system reboot or scheduled maintenance to achieve persistence and privilege escalation.
This technique often involves exploiting misconfigurations or oversights in security policies, typically resulting from improper system administration or insecure default installations.
When this Technique is Usually Used
Attackers typically leverage the Services File Permissions Weakness sub-technique in the following scenarios and stages:
Privilege Escalation:
Attackers who have gained initial access with limited permissions can escalate their privileges by exploiting weak permissions on service executables or configurations.
Common during post-exploitation stages after initial compromise.
Persistence:
Attackers modify service files or executables to ensure malicious code execution at system startup or service restart.
Commonly used to maintain long-term persistence on compromised systems.
Lateral Movement and Credential Access:
Attackers may exploit permissions weaknesses on shared services or remote machines to move laterally within the network.
Services running with elevated privileges (e.g., SYSTEM, Administrator accounts) are particularly attractive targets.
Defense Evasion:
Attackers may disguise malicious payloads by replacing legitimate service executables, making detection challenging.
Leveraging existing, trusted services helps attackers evade endpoint detection solutions.
How this Technique is Usually Detected
Detection of this sub-technique involves monitoring, auditing, and analyzing system configurations, file permissions, and service behaviors. Common detection methods include:
File Permission Auditing:
Regularly audit file permissions on critical service executables, DLLs, and configuration files using built-in tools (
icacls,cacls) or third-party utilities (e.g., Sysinternals AccessChk).Detect unauthorized or suspicious permission changes.
Integrity Monitoring:
Deploy file integrity monitoring (FIM) solutions to detect unauthorized modifications or replacements of service executables and configurations.
Monitor hashes and digital signatures of critical service files.
Event Log Analysis:
Analyze Windows security and system event logs for unusual service restarts, service crashes, or unexpected behavior.
Identify suspicious events such as unexpected service configuration changes (Event IDs 7045, 7035, 7036).
Endpoint Detection and Response (EDR) Solutions:
Utilize EDR tools to detect anomalous behavior, such as new or modified executables running as services, or suspicious DLL loading patterns.
Identify and alert on unusual access patterns or privilege escalations.
Indicators of Compromise (IoCs):
Unexpected changes to service binary paths or configuration files.
Unrecognized or unsigned executables running as services.
File hashes or signatures not matching known legitimate versions.
Unauthorized accounts or groups granted write permissions on system service files.
Why it is Important to Detect This Technique
Early detection of Services File Permissions Weakness exploitation is critical due to significant potential impacts on systems and networks, including:
Privilege Escalation:
Attackers exploiting this technique can quickly escalate privileges from standard user to SYSTEM or administrator-level permissions, significantly increasing their ability to cause damage.
Persistence and Long-Term Compromise:
By modifying legitimate services, attackers can establish persistent footholds, making remediation more difficult and time-consuming.
Data Exfiltration and Theft:
Elevated privileges gained through this technique enable attackers to access sensitive data, credentials, and intellectual property.
Operational Disruption:
Modification of critical system services can lead to system instability, downtime, and business disruption.
Stealth and Defense Evasion:
Leveraging trusted services allows attackers to evade traditional security defenses, increasing the risk of prolonged compromise and data loss.
Compliance and Regulatory Implications:
Failure to detect and respond to privilege escalation and unauthorized persistence mechanisms can lead to regulatory violations, fines, and reputational damage.
Examples
Real-world examples and attack scenarios involving Services File Permissions Weakness include:
Privilege Escalation via Unquoted Service Paths:
Attackers exploit weak permissions combined with unquoted service paths to place malicious executables in directories that services inadvertently execute.
Tools: Metasploit modules (e.g.,
exploit/windows/local/trusted_service_path), PowerUp (PowerShell script).
DLL Hijacking via Weak Permissions:
Attackers exploit services loading DLLs from writable directories, replacing legitimate DLLs with malicious versions.
Tools: DLL hijacking frameworks, custom-crafted DLL payloads, PowerSploit.
Persistence Through Service Executable Replacement:
Attackers replace legitimate service executables (e.g., backup services, antivirus services) with malicious binaries due to overly permissive file permissions.
Impacts include long-term persistence, credential harvesting, and lateral movement across enterprise networks.
Real-World Incidents:
The NotPetya ransomware leveraged compromised services and weak file permissions to propagate and execute malicious payloads across corporate networks, causing widespread outages and financial damage.
Advanced Persistent Threat (APT) groups frequently exploit this sub-technique to maintain stealthy, persistent access to high-value targets.
These examples highlight the critical importance of proper file permission management, regular auditing, and proactive monitoring to mitigate the risks associated with Services File Permissions Weakness exploitation.
Last updated
Was this helpful?