Thread by @therealwlambert

🦖Day 4 of the @velocidex #velociraptor #ArtifactsOfAutumn series

Artifact: 'Windows.System.Services'

Link: docs.velociraptor.app/artifact_refer…

One might use this artifact to generate a baseline of normal Windows services, and look for services out of the ordinary. We can filter on display/service name, as well as DLL, path, etc. We can also calculate hashes and provide signing info for associated executables/DLLs.

Sorting on the 'Created' column shows the most recently created services (assuming no other manipulation, etc.). Here, we see a service named 'win32times', similar to the native Windows Time Service. We also see 'evilscript.ps1' being called by 'cmd', and no signing info.🦹🔍

Adversaries may attempt to give services/tasks names that are similar or identical to those of legitimate ones make it appear legitimate or benign (T1036.004).

From here, we could dive into 'evilscript.ps1' and/or other associated activity using other artifacts and techniques.

That's it for now. Stay tuned to learn about more artifacts! 🦖