MITRE ATT&CK T1569 System Services: Detecting Malicious Execution

Starting a program through the operating system's service manager is one of the most common ways attackers run code as SYSTEM or root, and one of the most common ways ransomware reaches every host in a network at once. MITRE ATT&CK tracks this as T1569 System Services, an Execution (TA0002) technique with three sub-techniques: T1569.001 Launchctl on macOS, T1569.002 Service Execution on Windows and T1569.003 Systemctl on Linux. This guide is for detection engineers, endpoint owners and incident responders. It concentrates on the execution step: the temporary remote service, the one-shot start, the abused daemon. Creating and modifying services for persistence is T1543, covered in the T1543 Create or Modify System Process Defensive Guide, which includes the full Event 4697 field reference this page does not repeat.

Key takeaways

• Execution, not persistence. ATT&CK separates running code through a service (T1569) from creating or changing a service to persist (T1543). Many attacks do both in seconds, so detection rules should cover the pair.
• Remote service execution is a lateral movement engine. Tools such as PsExec, Impacket modules, Winexe and xCmd create a service on a remote host, run a command and often delete the service again. CISA reports Medusa actors used PsExec to run scripts as SYSTEM and to push the encryptor across networks.
• Valid credentials are the prerequisite. Remote service creation needs administrative rights on the target. Every local administrator account and every service account with wide admin rights is a potential execution path.
• The parent process is the signal. On Windows, unusual children of services.exe; on Linux, unusual units started by systemctl; on macOS, launchctl loading plists from user-writable paths.
• ATT&CK lists four mitigations. M1018 User Account Management, M1022 Restrict File and Directory Permissions, M1026 Privileged Account Management and M1040 Behavior Prevention on Endpoint, including the Attack Surface Reduction rule that blocks process creations from PsExec.

What the technique covers

ATT&CK v20 (T1569 version 1.4) describes adversaries abusing system services or daemons to execute commands or programs, by interacting with or creating services locally or remotely.

Related techniques draw the edges: creating the service is T1543.003 Windows Service or T1543.002 Systemd Service; reaching the remote host over SMB is T1021 Remote Services; copying the payload there first is MITRE ATT&CK T1570 Lateral Tool Transfer; and the WMI alternative is covered in the T1047 Windows Management Instrumentation Defensive Guide.

How adversaries use it: real cases

T1569.002 has one of the longest procedure lists in ATT&CK v20. A representative selection, with the research ATT&CK cites:

Ransomware deployment

• Medusa Group (G1051): CISA's March 2025 advisory describes actors with valid credentials using PsExec to copy a batch script to remote machines and run it as SYSTEM, including a script that opened TCP 3389 and enabled remote WMI, then using PsExec, PDQ Deploy or BigFix to push the encryptor. See the Medusa Ransomware Threat Actor Profile.
• INC Ransom (G1032): ran a file encryption executable as a demand-start LocalSystem service named winupd, recorded as Service Control Manager event 7045 (Huntress, August 2023). See the INC Ransom and Lynx Ransomware Profile Guide.
• LockBit 3.0 (S1202), Pysa (S0583) and BlackByte (G1043): used PsExec or malicious services to execute ransomware (joint advisory June 2023, CERT-FR 2020, Symantec and Cisco).
• Embargo (S1247): created a service named irnagentd that ran its loader after rebooting the system into Safe Mode (ESET, October 2024), a route chosen because security tools may not run in Safe Mode.

Destructive and targeted intrusions

• NotPetya (S0368) and Olympic Destroyer (S0365): used PsExec to propagate across networks (Talos and US-CERT). HermeticWiper (S0697) creates services to execute its payload.
• Wizard Spider (G0102): used services.exe to execute scripts and executables during lateral movement, with batch scripts that use PsExec.
• APT38 (G0082): created new services or modified existing ones to run executables, commands or scripts (CISA AA20-239A, BeagleBoyz).
• SharePoint ToolShell exploitation (C0058): threat actors used PsExec for command execution and services.exe in disabling Microsoft Defender through registry keys.

Linux, macOS and network daemons

• TeamTNT (G0139): created system services to run cryptocurrency mining software (Cisco Talos).
• CanisterWorm (S9042): ran systemctl --user daemon-reload, then enabled and started a malicious user service (Aikido, March 2026). User-level units need no root, which makes them attractive on build agents and developer hosts.
• AppleJeus (S0584) and Cuckoo Stealer (S1153): loaded plists with launchctl (CISA, February 2021; Kandji, April 2024).
• Salt Typhoon (G1045): used the SNMP daemon to execute commands, including SNMPwalk (CISA AA25-239A, September 2025). See the Salt Typhoon Threat Actor Profile.

What to detect and where

MITRE's four detection strategies give the platform analytics below. The Windows rules overlap with T1543 because the same events record both creation and execution.

Remote service execution patterns

• Logon then service: a network logon (4624 logon type 3) from another workstation or server, followed within seconds by 4697 or System 7045 for a new service and a child of services.exe on the same host.
• Fan-out: the same source host creating services on many targets in a short window. This is the strongest ransomware deployment signal.
• Short-lived services: service names that appear once, run once and are deleted, a behaviour ATT&CK records for Winexe, Mafalda and similar tools.
• Admin share writes before execution: a binary written to ADMIN$ or C$ and then registered as a service binary path.
• Endpoint rule telemetry: Microsoft Defender advanced hunting records the PsExec and WMI rule as AsrPsexecWmiChildProcessAudited in audit mode and AsrPsexecWmiChildProcessBlocked in block mode.

Impacket's service execution modules leave a distinct pattern; see the Impacket Detection Guide.

Mitigations and hardening

The four ATT&CK v20 mitigations, with the practical controls behind them:

CISA's Medusa advisory adds network controls that cut remote service execution off at the transport layer: segment networks, block traffic from unknown or untrusted origins to remote services on internal systems, require VPNs or jump hosts for remote access, and audit administrative accounts for least privilege. In practice that means host firewalls that allow SMB to workstations only from management systems.

Where identity fits

Every remote service execution is an authenticated administrative action, so the identity that made it is the investigation's first lead. Shared local administrator passwords let one compromised host unlock every other; LAPS removes that. Service accounts used by deployment, backup and monitoring tools often hold local admin on every server, which is exactly what PsExec-style tools need, and Medusa actors used PDQ Deploy and BigFix as well as PsExec. Inventory which non-human identities hold admin rights across many hosts, restrict where they can log on from, and alert when one creates a service from an unusual source. See the Local Administrator Password Solution (LAPS) Guide, the Tiered Administration and Enterprise Access Model Guide and How to find Windows services running as domain accounts.

How to test and roll out

1. Turn on the telemetry: Audit Security System Extension for 4697, System log 7045, Sysmon process creation and registry events on service keys; auditd rules for systemctl and unit directories; unified log or EDR on macOS launch items.
2. Baseline legitimate remote execution: list the tools and service accounts that run code remotely through services (software deployment, patching, backup, monitoring) and the hosts they run from.
3. Emulate: in a test segment, an authorised tester runs a benign command remotely through a temporary service, starts a test systemd unit as a non-root user, and loads a test launch agent. Use an emulation framework mapped to T1569 and confirm each analytic fires.
4. Deploy the ASR rule in audit: collect AsrPsexecWmiChildProcessAudited events for two to four weeks, identify legitimate tools that trigger it, and move pilot rings to block.
5. Restrict SMB and RPC paths: host firewall rules so workstations accept administrative connections only from management hosts; pilot on one site first.
6. Roll back: return the ASR rule to audit for affected device groups, or revert the firewall policy for a ring, and record the exception against a named tool and owner.

Metrics

• Share of Windows hosts logging 4697 and 7045 centrally, and of Linux hosts with systemctl auditing.
• Devices with the PsExec and WMI ASR rule in block mode, as a share of eligible devices.
• Number of accounts, human and non-human, with local admin on more than 50 hosts.
• Remote service creations per week from sources outside the approved management hosts (target: zero).
• Time from a test remote service execution to SOC alert in purple team exercises.

Common failure patterns

• Allowlisting PsExec by name: attackers use the same tool administrators use, and Microsoft documents a PsExec option (-r) that sets the name of the remote service to create, so name-based exclusions are fragile.
• Excluding deployment tool accounts wholesale: Medusa used deployment tools to push ransomware; their service accounts need baselines, not blanket exclusions.
• Logging service creation only: 4697 records install time; the execution and the deletion that follow need process and registry telemetry.
• Ignoring user-level systemd units: user services run without root and are rarely monitored on build agents.
• Flat SMB access: every workstation able to reach every other on port 445 turns one admin credential into fleet-wide execution.
• ASR rule enabled on Configuration Manager clients: Microsoft warns this conflicts with the client's use of WMI.

Framework mapping

Practitioner checklist

• Log 4697, 7045, process creation and service registry changes centrally on Windows.
• Audit systemctl execution and unit file writes on Linux, including user units.
• Monitor launch item plists and launchctl use on macOS.
• Alert on one source creating services on many hosts, and on services installed and deleted within minutes.
• Deploy the PsExec and WMI ASR rule in audit, then block, outside Configuration Manager clients.
• Use LAPS and tiered admin accounts so one credential does not unlock every host.
• Baseline deployment, backup and monitoring service accounts and restrict where they log on from.
• Limit SMB and RPC administrative access to workstations from management hosts only.

Standards and references

• MITRE ATT&CK: System Services (T1569)
• MITRE ATT&CK: Service Execution (T1569.002)
• Microsoft: Attack surface reduction rules reference
• Microsoft: 4697(S) A service was installed in the system
• Microsoft Sysinternals: PsExec
• CISA: #StopRansomware: Medusa Ransomware (AA25-071A)
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: ATT&CK Execution Tactic Guide · T1543 Create or Modify System Process Defensive Guide · Lateral Movement Guide · Impacket Detection Guide · Local Administrator Password Solution (LAPS) Guide