Service Failure Command

A command the service control manager runs when a service fails, often as SYSTEM.

Use it to find a command set to run when a service fails, which then runs as the service account, often SYSTEM.

  • SYSTEM
  • Persistence

What It Is

Windows lets each service define recovery actions that the service control manager takes when the service fails, meaning it stops without reporting a clean stop. One action can run a command, whose command line is set by the command= option of the sc failure tool and runs under the same account as the service. These recovery settings are stored under the service's own key in HKLM SYSTEM under CurrentControlSet\Services. The reset period, an optional reboot message and up to three actions are configured together.

What It Proves

A FailureCommand value, with FailureActions set to run it, makes the service control manager run that command when the service crashes. The command runs under the service account, which is often SYSTEM.

What It Does Not Prove

It fires on failure, not on a schedule, so the attacker must be able to crash the service. A few genuine services set recovery commands, so judge by the command.

Where It Lives

Service Failure Command lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SYSTEM\ControlSet001\Services\<name>
Hive file: C:\Windows\System32\config\SYSTEM

What It Looks Like

These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Service Failure Command, each with what it tells you
Registry ValueWhat It Tells You

BITS\FailureActions

REG_BINARY80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 14 00 00 00 01 00 00 00 60 EA 00 00 01 00 00 00 C0 D4 01 00 00 00 00 00 00 00 00 00

On failure BITS is restarted after 60, then 120 seconds, with a one day reset and no run program action (type 3). Decode each service the same way.

BITS\FailureCommand

REG_SZ(not present)

BITS has no FailureCommand, so nothing extra runs when it fails. Check the new Windows Update Helper service the same way.

How to Read It

For each service, read FailureCommand and decode FailureActions for the recovery steps. A run program action pointing at an odd path, with FailureCommand set, is the signal. Confirm the service account, since the recovery command runs in that context.

When Windows Writes It
When a service recovery action or failure command is set.
Which Windows Versions
Windows XP to 11
Tools That Parse It
Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents (documentation, opens in a new tab)

Defender records these writes within retention. A hit shows recovery settings, not a crash or the command running. A FailureCommand in a user folder is the signal.

KQLDefender XDR, Advanced hunting
// FailureCommand or FailureActions being written on a serviceDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey contains @"\Services\" and RegistryValueName in~ ("FailureCommand", "FailureActions")| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Service Failure Command shows.

  • ServicesHolds the service whose failure runs the command, and the account it runs as.
  • AmcacheGives the SHA-1 of the program the failure command runs.

Sources

The facts on this page come from these public pages, which say more on each point.