Hunting Rituals #2.2: Threat hunting for abuse of Windows Services

This article provides practical threat hunting guidance for Windows service execution (MITRE ATT&CK T1569.002), detailing hypotheses and EDR-driven methods to detect EXE services spawned by services.exe and DLL services loaded by svchost.exe, along with techniques for baselining, statistical analysis, signature filtering, and investigative pivoting when service installation telemetry is unavailable.