Analytics BIOC
Informational
✕
Commonly abused process launched as a system service
This commonly abused host process has been launched by a services.exe parent, indicating it has been installed as a system service. This behavior can have legitimate uses, but often used by malware as a persistence mechanism.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: System Services: Service Execution (T1569.002)
Attacker's goals:
Attackers may use services to persist or execute commands on remote hosts.
Investigative actions:
Check whether additional malicious commands were executed from the same process. Verify if the command-line seems suspicious or contains malicious indicators.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day