Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.[1] On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters.[2]
Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.
Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.[3]
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.
0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.
8
Tools & malware72nd pct
Tools & malware72nd percentile · 71% of ATT&CK techniques have fewer tools implementing them.
19
Detection rulesTop 14%
Detection rules86th percentile · 85% of ATT&CK techniques have fewer detection rules written.
Create or Modify System Process MITRE reference T1543
72nd pctamong all ATT&CK techniques for number of tools
8 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Create or Modify System Process detection strategy DET0571
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of System Process Creation or Modification Across Platforms
Enterprise
4 platforms
AN1575 · Windows
Detects command-line or API-based creation/modification of Windows Services via sc.exe, powershell.exe, services.exe, or ChangeServiceConfig. Looks for creation/modification of autostart services via registry changes, file drops to System32\services, and anomalous parent-child process trees.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Detects creation or modification of systemd service units, addition of cron jobs that invoke binaries on boot, or suspicious writes to /etc/init.d/. Monitors chmod +x and systemctl execution paths, especially from non-root parent processes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
execution of systemctl or service with enable/start/modify
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ServicePathRegex
Path-based filters to identify service unit files or init scripts
UserContextList
List of expected user contexts that normally perform service changes
CommandNameList
Binaries used to register/modify services
AN1577 · macOS
Detects creation or modification of LaunchDaemon or LaunchAgent plist files under /Library/LaunchDaemons/, ~/Library/LaunchAgents/, or similar. Monitors execution of launchctl, property list edits, and file permission changes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
PlistPathList
Watched directories for LaunchDaemons and LaunchAgents
PlistKeyMonitor
Monitored keys such as RunAtLoad, KeepAlive, or ProgramArguments
UnsignedBinaryAlert
Flag execution of unsigned or non-Apple-signed binaries within plist
AN1578 · Containers
Detects creation of new container system processes via docker run --restart, kubectl exec to init containers, or modification of container init specs. Flags container images that override entrypoints to embed persistence behaviors.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent an application from writing a signed vulnerable driver to the system. On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed drivers.
Where possible, consider enforcing the use of container services in rootless mode to limit the possibility of privilege escalation or malicious effects on the host running the container.
Limit privileges of user accounts and groups so that only authorized administrators can interact with system-level process changes and service configurations.
Create or Modify System Process detections T1543
19 rules are mapped to this technique.
Top 14%of all ATT&CK techniques for number of rules
Showing 1-19 of 19 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Splunk
Detects process executions that occur well after a container has initialized, which can indicate
sus (...)
This analytic detects the execution of the nsenter utility from within a container, a technique often used for exploitation and container escape. (...)
The following analytic identifies the creation of a service with a known name used by CLOP ransomware for persistence and high-privilege code execution. (...)
Detects the creation of Large Language Model (LLM) files on Windows endpoints by monitoring file creation events for specific model file formats and extensions commonly used by local AI frameworks. (...)
The following analytic detects execution of unauthorized local LLM frameworks (Ollama, LM Studio, GPT4All, Jan, llama.cpp, KoboldCPP, Oobabooga, NutStudio) and Python-based AI/ML libraries (HuggingFace Transformers, LangChain) on Windows endpoints by leveraging process creation events. (...)