Weak Registry Permissions
MITRE ATT&CK™ Hijack Execution Flow - Services Registry Permissions Weakness - Technique T1574.011
Last updated
Was this helpful?
MITRE ATT&CK™ Hijack Execution Flow - Services Registry Permissions Weakness - Technique T1574.011
Last updated
Was this helpful?
By hijacking the Registry entries utilized by services, attackers can run their malicious payloads. Attackers may use weaknesses in registry permissions to divert from the initially stated executable to one they control upon Service start, allowing them to execute their unauthorized malware.
An attacker can leverage this misconfiguration to modify the ImagePath of service with the path of the custom malicious executable that will give an escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).
Or we can use the servicesinfo module of
