T1569.002 — Service Execution

Tactic: Execution · Platforms: Windows

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services. The service control manager is accessible to users via GUI components as well as system…

Sub-technique of System Services (T1569).

Sigma detection rules (1)

T1569.002 System Services: Service Execution

title: "T1569.002 System Services: Service Execution"
id: eeb2b340-eeff-4399-a71e-28a4f572dab6
description: 'Detection Strategy for System Services Service Execution: sc.exe creating a new service, or the Service Control Manager (services.exe) spawning a command interpreter/PsExec service host as a child process -- the concrete process-creation artifacts of abusing the SCM to execute payloads. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ServiceBinaryAllowlist, ParentProcessCorrelationWindow, RemoteExecutionHosts.'
references:
  - https://attack.mitre.org/techniques/T1569/002
author: Shahrukh Khan
date: 2026-03-03
license: MIT
tags:
  - attack.execution
  - attack.t1569.002

logsource:
  category: process_creation
  product: windows

detection:
  selection_sc_create:
    Image|endswith: '\sc.exe'
    CommandLine|contains: 'create'

  selection_service_shell:
    ParentImage|endswith: '\services.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\PSEXESVC.exe'

  condition: 1 of selection_*

falsepositives:
  - Legitimate software installers/administration using sc.exe to create services, and services that legitimately spawn a command interpreter for scripted maintenance tasks; tune with ServiceBinaryAllowlist, ParentProcessCorrelationWindow, RemoteExecutionHosts.

level: medium

Related sub-techniques

Explore