Cross-source coverage
T1543 / ATT&CK
Create or Modify System Process
257 rules · 251 families across 12 sources.
2 atomic-IOC hidden · include
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters.
Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.
Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.
- Tactics
- Persistence · Privilege Escalation
- Platforms
- Containers · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogfs:fsusagedocker:events
How MITRE says to detect it DET0571
Detection of System Process Creation or Modification Across Platforms
Windows Analytic 1575
Detects command-line or API-based creation/modification of Windows Services via `sc.exe`, `powershell.exe`, `services.exe`, or `ChangeServiceConfig`. Looks for creation/modification of autostart services via registry changes, file drops to `System32\services`, and anomalous parent-child process trees.
WinEventLog:SecurityEventCode=4697WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=13, 14
Linux Analytic 1576
Detects creation or modification of `systemd` service units, addition of cron jobs that invoke binaries on boot, or suspicious writes to `/etc/init.d/`. Monitors `chmod +x` and `systemctl` execution paths, especially from non-root parent processes.
auditd:SYSCALLwrite or rename to /etc/systemd/system or /etc/init.dauditd:SYSCALLexecution of systemctl or service with enable/start/modify
macOS Analytic 1577
Detects creation or modification of `LaunchDaemon` or `LaunchAgent` plist files under `/Library/LaunchDaemons/`, `~/Library/LaunchAgents/`, or similar. Monitors execution of `launchctl`, property list edits, and file permission changes.
macos:unifiedloglaunchctl load/unload or plist file modificationfs:fsusagefile write to launchd plist paths
Containers Analytic 1578
Detects creation of new container system processes via `docker run --restart`, `kubectl exec` to init containers, or modification of container init specs. Flags container images that override entrypoints to embed persistence behaviors.
docker:eventsdocker run with restart=always or modifying initauditd:SYSCALLmodification of entrypoint scripts or init containers
Sub-techniques with coverage
Counted in the 257 above — a rule tagged a sub-technique covers this technique too.
elastic/detection-rules
84 rules| Detection | Severity | Format |
|---|---|---|
| Persistence via a Hidden Plist Filename | High | Elastic TOML |
| Persistence via Suspicious Launch Agent or Launch Daemon | High | Elastic TOML |
| Persistence via Update Orchestrator Service Hijack | High | Elastic TOML |
| Persistence via WMI Standard Registry Provider | High | Elastic TOML |
| Service Creation via Local Kerberos Authentication | High | Elastic TOML |
| Suspicious Echo or Printf Execution Detected via Defend for Containers | High | Elastic TOML |
| Suspicious ImagePath Service Creation | High | Elastic TOML |
| Unusual Pkexec Execution | High | Elastic TOML |
| Windows Service Installed via an Unusual Client | High | Elastic TOML |
| Authentication via Unusual PAM Grantor | Medium | Elastic TOML |
+ 74 more from elastic/detection-rules → showing the 10 highest-severity
SigmaHQ/sigma
61 rules| Detection | Severity | Format |
|---|---|---|
| CobaltStrike Service Installations - System | Critical | Sigma |
| CosmicDuke Service Installation | Critical | Sigma |
| Moriya Rootkit File Created | Critical | Sigma |
| Moriya Rootkit - System | Critical | Sigma |
| OilRig APT Activity | Critical | Sigma |
| OilRig APT Registry Persistence | Critical | Sigma |
| OilRig APT Schedule Task Persistence - Security | Critical | Sigma |
| OilRig APT Schedule Task Persistence - System | Critical | Sigma |
| Turla PNG Dropper Service | Critical | Sigma |
| Allow Service Access Using Security Descriptor Tampering Via Sc.EXE | High | Sigma |
+ 51 more from SigmaHQ/sigma → showing the 10 highest-severity
splunk/security_content
34 rules| Detection | Severity | Format |
|---|---|---|
| Cisco Isovalent - Late Process Execution | Undefined | SPL |
| Cisco Isovalent - Nsenter Usage in Kubernetes Pod | Undefined | SPL |
| Cisco Isovalent - Shell Execution | Undefined | SPL |
| Clop Ransomware Known Service Name | Undefined | SPL |
| CMD Echo Pipe - Escalation | Undefined | SPL |
| Impacket Lateral Movement Commandline Parameters | Undefined | SPL |
| Impacket Lateral Movement smbexec CommandLine Parameters | Undefined | SPL |
| Impacket Lateral Movement WMIExec Commandline Parameters | Undefined | SPL |
| LLM Model File Creation | Undefined | SPL |
| MacOS Kextload Usage | Undefined | SPL |
+ 24 more from splunk/security_content → showing the 10 highest-severity
elastic/protections-artifacts
28 rules| Detection | Severity | Format |
|---|---|---|
| Driver Dropped by Untrusted Executable | Undefined | Elastic TOML |
| Egress Connection by a DNF Package Manager Descendant | Undefined | Elastic TOML |
| Egress Connection by a YUM Package Manager Descendant | Undefined | Elastic TOML |
| Egress Network Connection from Default DPKG Directory | Undefined | Elastic TOML |
| Egress Network Connection from RPM Package | Undefined | Elastic TOML |
| Hidden Payload Executed via Scheduled Job | Undefined | Elastic TOML |
| Initial Access via macOS Installer Package | Undefined | Elastic TOML |
| Kernel Driver Registered via NtLoadDriver | Undefined | Elastic TOML |
| Persistence via a Masqueraded Plist Filename | Undefined | Elastic TOML |
| Persistence via GenAI Tool | Undefined | Elastic TOML |
+ 18 more from elastic/protections-artifacts → showing the 10 highest-severity
socfortress/Wazuh-Rules
13 rules · 10 families| Detection | Severity | Format |
|---|---|---|
| Turla PNG Dropper Service | Critical | Wazuh XML |
| Detects a creation of systemd services which could be used by adversaries to execute malicious code. | High | Wazuh XML |
| Detects a reload or a start of a service. 2 variants | High | Wazuh XML |
| T1543.003 - Windows Service Configuration Modification via Registry (ImagePath, ServiceDll, Type, Start) | High | Wazuh XML |
| Detects a reload or a start of a service. 2 variants | Medium | Wazuh XML |
| Potential rootkit activity: insmod command executed 2 variants | Medium | Wazuh XML |
| Potential rootkit activity: insmod command executed 2 variants | Medium | Wazuh XML |
| Sysmon - Event 12: RegistryEvent (Object create and delete) by · Service Creation (T1543) | Low | Wazuh XML |
| Sysmon - Event 13: RegistryEvent (Value Set) by · Service Creation (T1543) | Low | Wazuh XML |
| Sysmon - Event 14: RegistryEvent (Key and Value Rename) by · Service Creation (T1543) | Low | Wazuh XML |
+ 3 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
Wazuh Core Ruleset
12 rules · 11 families| Detection | Severity | Format |
|---|---|---|
| Volume Shadow Copy Service: COM+ database corrupted, writers will not receive events. | Medium | Wazuh XML |
| Bad return code detected during internal processing of the EventSystem service. | Low | Wazuh XML |
| Evidence of new service creation found in registry under binary is · win.eventdata.details = (?i)\.exe, win.eventdata.targetObject = (?i)System\\\\CurrentControlSet\\\\Services | Low | Wazuh XML |
| MS-DHCP: Service authorized in AD. | Low | Wazuh XML |
| MS-DHCP: Started. | Low | Wazuh XML |
| MS-DHCP: The log was started. | Low | Wazuh XML |
| MS-DHCP: The log was stopped. | Low | Wazuh XML |
| New Windows Service Created | Low | Wazuh XML |
| Powershell script executed "New-Service" command | Low | Wazuh XML |
| The Event log service was started 2 variants | Low | Wazuh XML |
+ 2 more from Wazuh Core Ruleset → showing the 10 highest-severity
chainguard-dev/osquery-defense-kit
9 rules · 8 families| Detection | Severity | Format |
|---|---|---|
| Find launchd entries which purport to be by Apple, but point to binaries that are not signed by Apple. | Undefined | osquery SQL |
| Funky systemd units, may be evidence of persistence | Undefined | osquery SQL |
| Reveal launchd services which are located in a hidden directory. | Undefined | osquery SQL |
| Suspicious calls to systemctl(event-based) | Undefined | osquery SQL |
| Unexpected launchd scripts that use the 'program_arguments' field | Undefined | osquery SQL |
| Unexpected launchd scripts that use the 'program' field | Undefined | osquery SQL |
| Unexpected long-running processes running as root 2 variants | Undefined | osquery SQL |
| Unexpected long-running processes running as root 2 variants | Undefined | osquery SQL |
| Unexpected systemd units, may be evidence of persistence | Undefined | osquery SQL |
chronicle/detection-rules
6 rules| Detection | Severity | Format |
|---|---|---|
| win_susp_or_malicious_service_created | Medium | YARA-L |
| fireeye_red_team_tool__modified_impacket_smbexec_via_cmdline | Undefined | YARA-L |
| fireeye_red_team_tool__modified_impacket_smbexec_via_registry | Undefined | YARA-L |
| mitre_attack_T1543_001_macos_launch_agent | Undefined | YARA-L |
| mitre_attack_T1543_004_macos_launch_daemon | Undefined | YARA-L |
| possible_impacketobfuscation_wmiexec_or_smbexec_utility_via_cmdline | Undefined | YARA-L |
Azure/Azure-Sentinel
3 rules| Detection | Severity | Format |
|---|---|---|
| COM Event System Loading New DLL | Medium | KQL |
| SUNBURST suspicious SolarWinds child processes (Normalized Process Events) | Medium | KQL |
| Rare-process-as-a-service | Undefined | KQL |
falcosecurity/rules
3 rules| Detection | Severity | Format |
|---|---|---|
| Create files below dev | High | Falco YAML |
| Write below binary dir | High | Falco YAML |
| Write below monitored dir | High | Falco YAML |
Bert-JanP/Hunting-Queries-Detection-Rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Azure ARC Related Persistence Detection | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |
panther-labs/panther-analysis
2 rules| Detection | Severity | Format |
|---|---|---|
| Databricks Install Library on All Clusters | Medium | Panther Python |
| Kubernetes DaemonSet Created | Informational | Panther Python |