A new tool called RecoverIt gives red teamers a sneaky way to move sideways in networks and stay persistent.
It abuses Windows’ built-in service recovery feature, dodging common detection tools that watch for new services or changed file paths.
Attackers have long used tools like PsExec and Impacket to create or tweak Windows services for running malware. But these methods are noisy.
Defenders track the “ImagePath”, the file that a service runs closely. If it points to something suspicious like C:\Temp\malware.exe, endpoint detection tools (EDR) spot it fast. Even DLL hijacking is getting harder to hide.
Security researcher TwoSevenOneT created RecoverIt to fix this. It leaves the real ImagePath alone and targets the “Recovery” settings in a service’s properties instead.
Windows services have failure recovery options. If a service crashes, it can restart or run a custom program.
RecoverIt finds services that crash easily, like UevAgentService when disabled. It then sets the recovery to run a malicious command, such as a reverse shell.
The steps are straightforward:
- Pick a crash-prone service.
- Set recovery to execute your payload.
- Start the service, it crashes, and services.exe runs your code as “recovery.”
This runs with SYSTEM privileges, just like traditional methods, but stays stealthy. No new services or bad ImagePaths to flag.
Traditional vs. RecoverIt Comparison
| Feature | Traditional Service Abuse (PsExec, Impacket) | Service Recovery Abuse (RecoverIt) |
|---|---|---|
| Execution Vector | Uses the existing service’s “Failure Recovery” action. | Uses existing service’s “Failure Recovery” action. |
| ImagePath Status | Modified to suspicious binary (e.g., C:\Temp\malware.exe). | Untouched points to the legit file (e.g., svchost.exe). |
| Trigger Mechanism | Service start (payload runs right away). | Service crash (payload runs after failure). |
| Stealth Level | Low-medium; EDRs watch closely. | High; skips ImagePath and creation monitors. |
| Privileges | SYSTEM. | SYSTEM (via services.exe). |
| Main Artifacts | New service logs, disk binary, registry changes. | FailureCommand registry tweak, crash event logs. |
A glance shows a normal Microsoft-signed executable. The trick hides in the rarely checked FailureCommand.
Watch service recovery changes, especially odd commands in FailureCommand or FailureActions registry keys.
Track Event IDs 7024 and 7031 (service crashes/terminations), followed by services.exe spawning processes. Tools like Sysmon can help log these.
RecoverIt shows attackers are getting craftier. Defenders must monitor recovery configs to stay ahead.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
.webp?fit=1600,900&ssl=1&description=Attackers have long used tools like PsExec and Impacket to create or tweak Windows services for running malware. But these methods are noisy.){kind=link}