Threat actors may abuse system services or daemons to execute commands or programs. Threat actors can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence (Create or Modify System Process), but Threat actors can also abuse services for one-time or temporary execution.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.