AN1211: Analytic 1211
Modification or replacement of service executables due to weak file or directory permissions. Defender observes file writes to service binary paths, unexpected modifications of executables associated with registered services, and subsequent service execution of attacker-supplied binaries under elevated permissions.
Analyst context for executives and security teams
This analytic is about spotting a Windows service binary being modified or replaced where weak file or directory permissions allow it. The business significance is privilege and persistence risk: if an attacker can swap the executable used by a registered service, the next service start may run attacker-controlled code with the service’s elevated permissions. Leaders should treat this as both a detection and hardening issue, not only a malware issue.
Executive priority
Prioritize validation for business-critical Windows servers and endpoints where services run with elevated privileges. This behavior can turn a local permission weakness into higher-privilege execution, so it is relevant to operational resilience, incident response scoping, vulnerability and configuration management, and audit evidence around least privilege and change control. Ask whether teams can prove which service binaries are writable, which were changed, and whether service execution followed an unauthorized change.
Technical view
For SOC, detection engineering, and IR teams, the core validation is correlation: file writes or replacements at paths used by registered Windows services, unexpected modification of service-associated executables, and subsequent execution by the service mechanism under elevated permissions. Because no official detection logic is provided, teams should derive local analytics from Windows service inventory, service binary path metadata, file modification events, process execution events, and permission baselines. Tune against approved software updates, patching, installer activity, and administrative maintenance windows.
Likely telemetry
- Windows file creation/modification events for service executable paths
- Windows service inventory and registered service binary path metadata
- Process execution telemetry showing service-launched binaries
- File and directory permission or ACL baselines for service paths
- Change-management, software deployment, and patching records for false-positive review
Detection direction
- Build a baseline of registered Windows services and their expected executable paths, owners, hashes, and permissions.
- Alert on writes, replacements, or unexpected hash changes to executables associated with registered services, especially where the path is writable by non-administrative or overly broad principals.
- Correlate service binary modification with later service start or process execution from the modified path.
- Suppress or annotate expected activity from approved installers, patch tools, and maintenance windows rather than broadly excluding service directories.
- Review blind spots where endpoint telemetry does not capture file writes, where service inventory is stale, or where permission data is not collected.
Mitigation priorities
- Inventory Windows services and identify service executable paths with weak file or directory permissions.
- Harden ACLs so only authorized administrators and trusted deployment mechanisms can modify service binaries and parent directories.
- Use change control and integrity monitoring for service executables on critical systems.
- Ensure incident response playbooks include service binary replacement checks when investigating suspicious elevated execution.
- Retain enough endpoint and file telemetry to reconstruct modification timing, responsible account or process, and subsequent service execution.
Analyst notes and limits
The supplied ATT&CK object is a detection analytic for Windows. It describes the behavior and observable pattern but does not provide formal detection logic, tactics, mitigations, data sources, or relationship context. The strongest defensive value comes from combining service inventory, file integrity/change telemetry, process execution telemetry, and permission review.
No official detection content or relationships were supplied, and tactics are not specified. This take should not be read as evidence of active exploitation, attribution, or guaranteed detection coverage. Local service configurations, telemetry quality, and administrative software deployment practices determine practical fidelity.
Analytic 1211
Modification or replacement of service executables due to weak file or directory permissions. Defender observes file writes to service binary paths, unexpected modifications of executables associated with registered services, and subsequent service execution of attacker-supplied binaries under elevated permissions.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 96dd5b549508… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1211Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.