Compliance Node Overview
MITRE ATT&CK T1569.002 (Service Execution) is an Enterprise Execution sub-technique of T1569 (System Services). Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services. The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API. Affected platforms: Windows. MITRE-documented mitigations include M1026 Privileged Account Management, M1040 Behavior Prevention on Endpoint, M1022 Restrict File and Directory Permissions. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, CA-07, CM-02, CM-05, CM-06.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1569/002/
SHA-256 integrity: ae667621a5a1aca396200303a12dcdf7bf7723fb14c58887490832c0c0cfbd9d
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1569.002: Service Execution (https://attack.mitre.org/techniques/T1569/002/)
- MITRE ATT&CK Tactic TA0002: Execution (https://attack.mitre.org/tactics/TA0002/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
⚠ Important: Human Verification Required
Bidda compliance nodes are reference intelligence, not legal advice. Every node must be reviewed by a qualified compliance professional or legal counsel before implementation in any enterprise workflow, regulated system, or compliance programme. See bidda.com/disclaimer for full terms.