Threat intelligence / Mitigation

New Service Mitigation

Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create new services. Identify and block unnecessary system utilities or potentially malicious software that may be used to create services by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Mitigation

TypeMitigation

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create new services. Identify and block unnecessary system utilities or potentially malicious software that may be used to create services by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

0 recorded

Relationships

No relationships recorded.

6 external

References

mitre-attack

T1050

Beechey 2010

http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599

Windows Commands JPCERT

http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html

NSA MS AppLocker

https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm

Corio 2008

http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx

TechNet Applocker vs SRP

https://technet.microsoft.com/en-us/library/ee791851.aspx