Service

On Unix the traditional term is daemon: a process that detaches from its controlling terminal by forking, calling setsid(), forking again, changing to the root directory and closing inherited file descriptors, then usually drops privileges after binding any privileged ports. Modern service managers make most of that unnecessary. systemd describes each service in a unit file with directives such as ExecStart=, Type= (simple, forking, notify, oneshot), User=, Restart= and dependencies (Wants=, After=), starts it in its own cgroup so every child process is tracked and can be killed reliably, and captures its output in the journal. Socket activation lets systemd hold the listening socket and start the service on first connection. launchd plays the same role on macOS.

On Windows, the Service Control Manager (services.exe) starts services registered under HKLM\SYSTEM\CurrentControlSet\Services, with a start type (automatic, delayed automatic, manual, disabled), recovery actions and an account. The built-in accounts differ sharply in power: LocalSystem has full local rights and the computer's identity on the network, LocalService and NetworkService are reduced, virtual accounts (NT SERVICE\name) give per-service identities, and group Managed Service Accounts (gMSA) provide domain identities with automatically rotated passwords. Many Windows services share svchost.exe host processes. Each service also gets a service SID that can be used in ACLs.

Services are high-value targets because they run continuously, often with elevated rights, and frequently listen on the network, so a remotely exploitable bug gives pre-authentication access with no user interaction; EternalBlue against SMBv1, used by WannaCry in 2017, is the canonical example. Local weaknesses are equally common: unquoted service paths containing spaces (CWE-428, ATT&CK T1574.009), service binaries or registry keys writable by ordinary users, and services running as LocalSystem when a restricted account would suffice. Attackers also create or modify services for persistence and privilege escalation (T1543.003 on Windows, T1543.002 for systemd), and service accounts with Kerberos SPNs and weak passwords are the target of Kerberoasting (T1558.003).

Hardening follows least privilege and least functionality: disable services that are not needed (CIS Benchmarks list them per OS), run each under a dedicated low-privilege or dynamically allocated account, and use sandboxing options; systemd offers directives such as NoNewPrivileges=, ProtectSystem=strict, ProtectHome=, PrivateTmp=, CapabilityBoundingSet= and SystemCallFilter=, and systemd-analyze security scores a unit's exposure. Inventory matters because forgotten services, such as remote-support agents and old management interfaces, are a typical initial-access path. The word is overloaded: an OS service is a local background process, whereas a network service, a microservice or an IT service in ITIL terms is a capability offered to clients, which may be implemented by one or many such processes.