How can a system service provide persistence?¶
A system service can provide persistence by starting software automatically and running it with defined privileges.
Avoid the dangerous assumption¶
The dangerous assumption is that a service running in the background is inherently suspicious.
Services are a normal part of operating systems and enterprise software.
A malicious or abused service may:
- launch malware
- run commands
- maintain remote access
- start at boot
- operate with high privilege
- hide behind a legitimate-looking name.
Investigators should preserve:
- the service name and identifier
- display name
- binary or command path
- creation and modification time
- startup type
- service account
- creator account or process
- start and stop history
- related files and network activity.
Do not rely only on the display name. A malicious service can imitate a legitimate product.
Likewise, a legitimate binary path does not prove legitimate use if arguments or configuration were altered.
The presence of a service does not prove it ran.
Service-control logs, process creation and resulting activity may show execution.
A service may also have been created by legitimate software deployment or system administration.
Compare the timing with authorised changes and the wider incident.
Preserve the configuration before deletion because removal may erase the strongest evidence of how persistence operated.
A service may be created remotely through administration tools or command execution. Correlate service creation with the originating session, account and process so the resulting background activity is not wrongly attributed to the local device user.
Operational takeaway¶
Establish who created or changed the service, what it launched, under which privilege and whether it actually ran.