Skip to main content

Services

Windows Services are a common form of persistence and privilege escalation on Windows systems. Service data is stored in the SYSTEM Registry file.
Services run with SYSTEM level privileges.

Other Parsers:

References:

TOML Collection​

[output]
name = "services_collection"
directory = "./tmp"
format = "jsonl"
compress = false
endpoint_id = "6c51b123-1522-4572-9f2a-0bd5abd81b82"
collection_id = 1
output = "local"
timeline = false

[[artifacts]]
artifact_name = "services"
[artifacts.services]
# alt_file = "C:\\Artifacts\\SYSTEM"

Collection Options​

  • alt_file Full path to alternative SYSTEM Registry file. This configuration is optional. By default artemis will parse the SYSTEM Registry at the default location.

Output Structure​

An array of Services entries

export interface Services {
  /**Current State of the Service */
  state: string;
  /**Name of Service */
  name: string;
  /**Display name of Service */
  display_name: string;
  /**Service description */
  description: string;
  /**Start mode of Service */
  start_mode: string;
  /**Path to executable for Service */
  path: string;
  /**Service types. Ex: KernelDriver */
  service_type: string[];
  /**Account associated with Service */
  account: string;
  /**Registry modified timestamp. May be used to determine when the Service was created */
  modified: string;
  /**DLL associated with Service */
  service_dll: string;
  /**Service command upon failure */
  failure_command: string;
  /**Reset period associated with Service */
  reset_period: number;
  /**Service actions upon failure */
  failure_actions: FailureActions[];
  /**Privileges associated with Service */
  required_privileges: string[];
  /**Error associated with Service */
  error_control: string;
  /**Registry path associated with Service */
  reg_path: string;
  /**Path to the Registry file */
  evidence: string;
}

/**
 * Failure actions executed when Service fails
 */
interface FailureActions {
  /**Action executed upon failure */
  action: string;
  /**Delay in seconds on failure */
  delay: number;
}