What MITRE ATT&CK T1574.010: Services File Permissions Weakness (Enterprise Tactic TA0003 - Persistence / TA0004 - Privilege Escalation / TA0005 - Defense Evasion) requires
MITRE ATT&CK T1574.010 (Services File Permissions Weakness) is an Enterprise Persistence and Privilege Escalation and Defense Evasion sub-technique of T1574 (Hijack Execution Flow). Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. Affected platforms: Windows. MITRE-documented mitigations include M1018 User Account Management, M1047 Audit, M1052 User Account Control. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-04, AC-05, AC-06, CA-07, CM-02, CM-05.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1574/010/
SHA-256 integrity: 0b47238fc3df4ff4a1553a19fdc139075bb84fe938ddfb38988bb4c41f4db822
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1574.010: Services File Permissions Weakness (https://attack.mitre.org/techniques/T1574/010/)
- MITRE ATT&CK Tactic TA0003: Persistence (https://attack.mitre.org/tactics/TA0003/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
⚠ Important: Human Verification Required
Bidda compliance nodes are reference intelligence, not legal advice. Every node must be reviewed by a qualified compliance professional or legal counsel before implementation in any enterprise workflow, regulated system, or compliance programme. See bidda.com/disclaimer for full terms.