Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence (Create or Modify System Process), but adversaries can also abuse services for one-time or temporary execution.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1569 | System Services |
Comments
Intel Threat Detection Technology (TDT), combined with CrowdStrike Falcon Accelerated Memory Scanning (CAMS), enhances cybersecurity defenses by enabling faster, real-time detection when system services are abused by adversaries. This integrated solution strengthens CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, all while minimizing system performance impact.
Abuse of System Services involves adversaries exploiting legitimate system services to execute malicious commands or maintain persistence on a compromised system. Attackers may manipulate services like Windows Management Instrumentation (WMI), Service Control Manager (SCM), or other system processes to gain unauthorized access, execute payloads, or escalate privileges. Intel TDT provides real-time telemetry on program execution, memory access, and control flow, allowing security teams to quickly detect abnormal behaviors, such as suspicious service manipulation or attempts to hijack system services for malicious purposes.
Additionally, CAMS offloads the performance-intensive task of memory scanning from the CPU to the Intel Integrated GPU, allowing for faster, more efficient detection of malicious activity without degrading system performance. CAMS helps identify suspicious behaviors, such as unauthorized service execution or attempts to abuse system services for lateral movement or persistence, providing proactive defense against these evasive attack techniques.
References
|