New RecoverIt Tool Abuses Windows Service Failure Recovery to Execute Malicious Payloads

RecoverIt is an offensive tool that enables stealthy lateral movement and persistence by modifying Windows service failure recovery actions (FailureCommand/FailureActions) to execute payloads when a service crashes, while leaving the legitimate ImagePath unchanged; this bypasses common EDR and service-creation detection that focus on ImagePath changes. The report details the attack flow (identify crash-prone service, modify recovery actions, trigger crash), shows artifacts to monitor (registry FailureCommand/FailureActions, Event IDs 7024/7031 and services.exe execution), and recommends expanding monitoring to include service recovery settings and associated event-log correlations.