{
  "family": "winsecsrv",
  "sample_count": 45,
  "category": "trojan",
  "description": "WinSecSrv (Windows Security Service Trojan) is a stealthy backdoor and trojan downloader active since 2012 that deliberately masquerades as a legitimate Windows core security service. Installed through exploit kits, cracked software bundlers, and malicious downloads, WinSecSrv registers a background Windows service under names like Windows Security Service or WinSecSrv. The malware bypasses user attention by disguising its binary inside %SystemRoot%\\System32 or %ProgramData%, injects into svchost.exe, and establishes encrypted communications with remote C2 infrastructure to download and stage secondary malicious payloads such as infostealers, cryptominers, and rootkits.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/WinSecSrv",
    "Trojan.Win32.WinSecSrv",
    "TrojanDownloader:Win32/WinSecSrv",
    "Win32/WinSecSrv"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/WinSecSrv?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "WinSecSrv is a trojan downloader that disguises itself as a legitimate Windows security service to maintain persistent backdoor access."
      }
    },
    {
      "@type": "Question",
      "name": "How does WinSecSrv achieve stealth persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It registers a Windows service disguised with standard security naming conventions to blend into task lists."
      }
    },
    {
      "@type": "Question",
      "name": "What actions are performed by WinSecSrv once installed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects into svchost.exe, beacons remote C2 servers, and downloads secondary malware payloads like miners or stealers."
      }
    },
    {
      "@type": "Question",
      "name": "How do endpoints become infected with WinSecSrv?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via web exploit kits, cracked software bundlers, and deceptive utility installers."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators remove WinSecSrv?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Stop and delete the malicious Windows service using sc.exe, remove the binary from disk, and run a complete antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1543.003",
    "T1036.004",
    "T1055",
    "T1105",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network; running as a `SYSTEM` level service grants the attacker total control over the machine.",
    "Utilize EDR or the command line (`sc stop` and `sc delete`) to forcefully terminate and remove the malicious service entry.",
    "Capture a forensic memory image to extract the configuration of the backdoor and identify the C2 server it was communicating with.",
    "Due to the `SYSTEM` level compromise, the most secure remediation is a complete, clean rebuild of the operating system."
  ],
  "what_to_avoid": [
    "Do not trust the name of any process in Task Manager; always verify the digital signature and file path of suspected services.",
    "Avoid assuming the threat is contained just by deleting the executable; the Service Control Manager will throw errors and may attempt to restart it."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Stealth Persistence & Payload Staging",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Exploit Kit Redirections",
    "Cracked Software Bundlers",
    "Deceptive System Optimizer Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server 2016"
  ],
  "capabilities": [
    "Windows Service Masquerading",
    "svchost.exe Process Injection",
    "Secondary Malware Downloader",
    "Encrypted C2 Beaconing",
    "System Architecture Discovery"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Service Binary)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons transmitting host GUIDs and service status to C2 IP endpoints",
      "HTTP GET requests downloading encrypted secondary payloads"
    ],
    "evasion_techniques": [
      "Registering with legitimate-sounding service descriptions",
      "Process hollowing into svchost.exe",
      "Storing binaries in protected system paths"
    ],
    "indicators": {
      "file_paths": [
        "%SystemRoot%\\System32\\winsecsrv.exe",
        "%ProgramData%\\WinSecSrv\\service_stub.dll"
      ],
      "registry_keys": [
        "HKLM\\System\\CurrentControlSet\\Services\\WinSecSrv"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Service Masquerading Backdoor"
    ],
    "variants": [
      "WinSecSrv.A",
      "WinSecSrv.Svc"
    ]
  },
  "iocs": {
    "file_hashes": [
      "ef45fa67ab7890123456789abcdef0123456789abcdef0123456789abcdef0123",
      "fa56ab78bc890123456789abcdef0123456789abcdef0123456789abcdef01234"
    ],
    "delivery": [
      "windows_security_optimizer_patch.exe",
      "directx_installer_bundle.exe"
    ],
    "persistence": [
      "HKLM\\System\\CurrentControlSet\\Services\\WinSecSrv"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/WinSecSrv",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/WinSecSrv"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.WINSECSRV",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.winsecsrv"
    }
  ]
}