services.exe

Overview

services.exe is the Service Control Manager responsible for starting, stopping, and managing Windows services. It enforces service configuration, launches service host processes, and maintains service state.

Expected location:

Expected parent:

Typical profile:

Why This Matters

Attackers frequently abuse Windows services for persistence and privilege escalation by creating or modifying services that execute malicious payloads.

This behaviour aligns with MITRE ATT&CK:

services.exe activity is often the earliest indicator of service-based persistence.

Investigation Objective

Determine whether services.exe is:

Particular attention should be paid to newly-created services, suspicious image paths, and unusual service accounts.

Normal Behaviour

Characteristics

Path

Parent

Signature

Lifetime

Children

Typically includes:

Typical Activity

Expected Behavioural Characteristics

Abuse Patterns

Path or Signature Mismatch

Investigate immediately if:

Any services.exe instance outside System32 should be treated as highly suspicious.

Unexpected Child Processes

Investigate services.exe spawning:

powershell.exe

cmd.exe

wscript.exe

cscript.exe

mshta.exe

rundll32.exe

unless a legitimate and documented service explains the behaviour.

Particular attention should be paid to scripting engines and command interpreters.

Service Creation or Modification Abuse

Investigate:

Examples include:

%TEMP%

%APPDATA%

%PUBLIC%

User profile paths

Service Account Abuse

Investigate:

Attackers frequently use service configuration changes to establish persistence.

One-Shot Service Behaviour

Investigate services that:

This pattern is frequently associated with lateral movement, remote execution, and malicious administration.

Driver and Kernel Abuse

Investigate:

Particular attention should be paid to Bring Your Own Vulnerable Driver (BYOVD) patterns.

Detection Opportunities

Event ID 7045 Monitoring

Windows Event ID 7045 remains one of the most valuable data sources for detecting service creation.

Investigate:

Where available, Event ID 7045 provides a strong starting point for triage.

Service Registry Monitoring

Monitor:

HKLM\SYSTEM\CurrentControlSet\Services

for:

Unexpected registry modifications frequently precede malicious service execution.

Service Path Analytics

Investigate services executing from:

The service binary often provides more investigative value than services.exe itself.

Process Lineage Monitoring

Review:

Unexpected lineage often indicates misuse of legitimate service infrastructure.

Driver Installation Monitoring

Alert on:

Driver-based abuse can rapidly escalate to full system compromise.

Hunting Opportunities

Useful hunting pivots include:

Prioritise service changes occurring immediately before suspicious activity elsewhere on the system.

False Positives

Some legitimate scenarios may trigger alerts involving services.exe.

Common Legitimate Scenarios

Software Installation and Updates

Examples include:

These activities frequently create or modify services.

Endpoint Security Products

Examples include:

Many security products install or modify services as part of legitimate operation.

Driver Installation

Examples include:

Legitimate driver installation commonly generates service-related events.

Validation Questions

Check:

Compare activity against known-good hosts where possible.

Hardening Recommendations

Service Governance

Maintain an inventory of:

Unknown services should be investigated promptly.

Restrict Service Creation

Limit the ability to:

Reducing service creation opportunities substantially increases attacker workload.

Application Control

Implement:

Preventing unauthorised service binaries from executing is often more effective than attempting to detect every persistence mechanism.

Monitor Critical Service Infrastructure

Maintain visibility into:

Monitoring should focus on service behaviour rather than process existence.

Service Account Management

Review:

Service accounts should follow the principle of least privilege wherever possible.

Defensive Validation

Test:

Defensive controls should be validated against realistic service-based persistence techniques.

Triage Checklist

Identity and Integrity Checks

Service Behaviour Checks

Child Process Review

Context and Scope

Escalation Considerations

Escalate immediately if:

ATT&CK References

Windows Processes

Windows Services

MITRE ATT&CK