System Services

What is System Services?

“System Services is documented as technique T1569 in MITRE ATT&CK® v19.1 under the Execution tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify System Services activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor Windows Event ID 7045 for new service installation and correlate with the executable path and digital signature status of the service binary, alerting on services pointing to unsigned executables in non-standard locations.

2. 2

   Alert on service creation using sc.exe or the Windows Service Control Manager API from processes other than legitimate installer applications, particularly when combined with encoded command line arguments or temporary file paths.

3. 3

   Detect malicious service names that mimic legitimate Windows services through exact name matching and fuzzy matching against the known good service catalog, as attackers frequently use slight variations of real service names.

4. 4

   Monitor for service binary path modifications, as attackers may hijack existing service configurations to execute malicious payloads while retaining the appearance of a legitimate service name and description.

5. 5

   Track short-lived service creation patterns, as some attack tools create services purely for one-time remote code execution and immediately delete them, leaving only brief windows for detection in event logs.

Example Alerts

These realistic alert examples show what System Services looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect System Services?

Detection centers on XDR, SIEM telemetry for the execution phase of the attack. Monitor Windows Event ID 7045 for new service installation and correlate with the executable path and digital signature status of the service binary, alerting on services pointing to unsigned executables in non-standard locations. Alert on service creation using sc.exe or the Windows Service Control Manager API from processes other than legitimate installer applications, particularly when combined with encoded command line arguments or temporary file paths.

What does a System Services alert look like?

A representative SIEM detection is "Malicious Service Created with SYSTEM Privileges" (high severity): Windows Event 7045 recorded: new service "Windows Network Helper" created with binary path pointing to C:\ProgramData\Temp\net_helper.exe. The executable is unsigned, was created 4 minutes ago by a PowerShell process, and its name closely mimics the legitimate Windows service "Windows Network List Service." The service runs as LocalSystem and is configured for automatic startup.

Which tools detect System Services, and how can I practice?

System Services (T1569) is best surfaced with XDR, SIEM telemetry, which exposes the execution signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.