{"id":"T1543","name":"Create or Modify System Process","url":"https://attack.mitre.org/techniques/T1543","tactics":["persistence","privilege-escalation"],"platforms":["Containers","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0571","stix_id":"x-mitre-detection-strategy--dab6c58b-2f44-4539-93e1-b03990fc1649","name":"Detection of System Process Creation or Modification Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0571","analytics":[{"id":"AN1575","stix_id":"x-mitre-analytic--9a65f8bc-1b81-4e05-8e8b-bfdb0d581213","name":"Analytic 1575","description":"Detects command-line or API-based creation/modification of Windows Services via `sc.exe`, `powershell.exe`, `services.exe`, or `ChangeServiceConfig`. Looks for creation/modification of autostart services via registry changes, file drops to `System32\\services`, and anomalous parent-child process trees.","url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1575","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4697","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ServiceNamePattern","description":"Regex patterns to flag unusual service names or binaries"},{"field":"ParentProcessFilter","description":"List of non-administrative processes starting service management tools"},{"field":"RegistryPathList","description":"Monitored autorun locations (e.g., `HKLM\\System\\CurrentControlSet\\Services`)"}],"live":true,"detection_strategies":["DET0571"],"techniques":["T1543"]},{"id":"AN1576","stix_id":"x-mitre-analytic--9a73d14c-ce3c-47c5-a6c2-3d6b49c4d009","name":"Analytic 1576","description":"Detects creation or modification of `systemd` service units, addition of cron jobs that invoke binaries on boot, or suspicious writes to `/etc/init.d/`. Monitors `chmod +x` and `systemctl` execution paths, especially from non-root parent processes.","url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1576","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"write or rename to /etc/systemd/system or /etc/init.d","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execution of systemctl or service with enable/start/modify","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ServicePathRegex","description":"Path-based filters to identify service unit files or init scripts"},{"field":"UserContextList","description":"List of expected user contexts that normally perform service changes"},{"field":"CommandNameList","description":"Binaries used to register/modify services"}],"live":true,"detection_strategies":["DET0571"],"techniques":["T1543"]},{"id":"AN1577","stix_id":"x-mitre-analytic--f315abd4-7115-45ac-9466-64c23367cd41","name":"Analytic 1577","description":"Detects creation or modification of `LaunchDaemon` or `LaunchAgent` plist files under `/Library/LaunchDaemons/`, `~/Library/LaunchAgents/`, or similar. Monitors execution of `launchctl`, property list edits, and file permission changes.","url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1577","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"launchctl load/unload or plist file modification","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsusage","channel":"file write to launchd plist paths","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"fs-fsusage"}],"mutable_elements":[{"field":"PlistPathList","description":"Watched directories for LaunchDaemons and LaunchAgents"},{"field":"PlistKeyMonitor","description":"Monitored keys such as `RunAtLoad`, `KeepAlive`, or `ProgramArguments`"},{"field":"UnsignedBinaryAlert","description":"Flag execution of unsigned or non-Apple-signed binaries within plist"}],"live":true,"detection_strategies":["DET0571"],"techniques":["T1543"]},{"id":"AN1578","stix_id":"x-mitre-analytic--52ee5593-7db2-4ad0-b5f4-630ebcf2ce0f","name":"Analytic 1578","description":"Detects creation of new container system processes via `docker run --restart`, `kubectl exec` to init containers, or modification of container init specs. Flags container images that override entrypoints to embed persistence behaviors.","url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1578","platforms":["Containers"],"log_source_references":[{"name":"docker:events","channel":"docker run with restart=always or modifying init","data_component":"DC0072","data_component_name":"Container Creation","log_source_slug":"docker-events"},{"name":"auditd:SYSCALL","channel":"modification of entrypoint scripts or init containers","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"EntrypointOverridePattern","description":"Patterns used to detect modified container start scripts"},{"field":"RestartPolicyMatch","description":"Policy values triggering alert (e.g., always, on-failure)"},{"field":"KubeInitModPath","description":"Path filters for `/etc/init.d/`-like behaviors inside containers"}],"live":true,"detection_strategies":["DET0571"],"techniques":["T1543"]}],"live":true,"version":"1.0","techniques":["T1543"]}],"sigma_rules":[{"id":"10cb6535-b31d-4512-9962-513dcbc42cc1","title":"PUA - System Informer Driver Load","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2023-05-08","modified":"2024-11-23","description":"Detects driver load of the System Informer tool","references":["https://systeminformer.sourceforge.io/","https://github.com/winsiderss/systeminformer"],"logsource":{"product":"windows","category":"driver_load"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1543"],"path":"rules/windows/driver_load/driver_load_win_pua_system_informer.yml","techniques":["T1543"],"cves":[]},{"id":"5722dff1-4bdd-4949-86ab-fbaf707e767a","title":"PUA - System Informer Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2023-05-08","modified":"2024-11-23","description":"Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations","references":["https://github.com/winsiderss/systeminformer"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.discovery","attack.stealth","attack.t1082","attack.t1564","attack.t1543"],"path":"rules/windows/process_creation/proc_creation_win_pua_system_informer.yml","techniques":["T1082","T1564","T1543"],"cves":[]},{"id":"67add051-9ee7-4ad3-93ba-42935615ae8d","title":"PUA - Process Hacker Driver Load","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-11-16","modified":"2024-11-23","description":"Detects driver load of the Process Hacker tool","references":["https://processhacker.sourceforge.io/"],"logsource":{"product":"windows","category":"driver_load"},"tags":["attack.persistence","attack.privilege-escalation","cve.2021-21551","attack.t1543"],"path":"rules/windows/driver_load/driver_load_win_pua_process_hacker.yml","techniques":["T1543"],"cves":["CVE-2021-21551"]},{"id":"71c276aa-49cd-43d2-b920-2dcd3e6962d5","title":"Service Installed By Unusual Client - System","author":"Tim Rauch (Nextron Systems), Elastic (idea)","status":"test","level":"high","date":"2022-09-15","modified":"2023-01-04","description":"Detects a service installed by a client which has PID 0 or whose parent has PID 0","references":["https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html"],"logsource":{"product":"windows","service":"system"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1543"],"path":"rules/windows/builtin/system/service_control_manager/win_system_service_install_sups_unusal_client.yml","techniques":["T1543"],"cves":[]},{"id":"811e0002-b13b-4a15-9d00-a613fce66e42","title":"PUA - Process Hacker Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-10-10","modified":"2024-11-23","description":"Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).\nProcess Hacker is a tool to view and manipulate processes, kernel options and other low level options.\nThreat actors abused older vulnerable versions to manipulate system processes.\n","references":["https://processhacker.sourceforge.io/","https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1622","attack.t1564","attack.t1543"],"path":"rules/windows/process_creation/proc_creation_win_pua_process_hacker.yml","techniques":["T1622","T1564","T1543"],"cves":[]},{"id":"9b72b82d-f1c5-4632-b589-187159bc6ec1","title":"CodeIntegrity - Blocked Driver Load With Revoked Certificate","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-06","modified":null,"description":"Detects blocked load attempts of revoked drivers","references":["https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations","Internal Research"],"logsource":{"product":"windows","service":"codeintegrity-operational"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1543"],"path":"rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml","techniques":["T1543"],"cves":[]},{"id":"c4e92a97-a9ff-4392-9d2d-7a4c642768ca","title":"Service Installed By Unusual Client - Security","author":"Tim Rauch (Nextron Systems), Elastic (idea)","status":"test","level":"high","date":"2022-09-15","modified":"2023-01-04","description":"Detects a service installed by a client which has PID 0 or whose parent has PID 0","references":["https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html","https://www.x86matthew.com/view_post?id=create_svc_rpc","https://twitter.com/SBousseaden/status/1490608838701166596"],"logsource":{"product":"windows","service":"security"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1543"],"path":"rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml","techniques":["T1543"],"cves":[]},{"id":"e4be5675-4a53-426a-8c81-a8bb2387e947","title":"CodeIntegrity - Blocked Image/Driver Load For Policy Violation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-11-10","modified":"2023-06-07","description":"Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.","references":["https://twitter.com/wdormann/status/1590434950335320065","https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations"],"logsource":{"product":"windows","service":"codeintegrity-operational"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1543"],"path":"rules/windows/builtin/code_integrity/win_codeintegrity_enforced_policy_block.yml","techniques":["T1543"],"cves":[]},{"id":"e97d9903-53b2-41fc-8cb9-889ed4093e80","title":"KrbRelayUp Service Installation","author":"Sittikorn S, Tim Shelton","status":"test","level":"high","date":"2022-05-11","modified":"2022-10-05","description":"Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)","references":["https://github.com/Dec0ne/KrbRelayUp"],"logsource":{"product":"windows","service":"system"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1543"],"path":"rules/windows/builtin/system/service_control_manager/win_system_krbrelayup_service_installation.yml","techniques":["T1543"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2023-0386","state":"stale","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-33053","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2025-4428","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2025-32709","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-32706","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-32701","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-44221","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2024-4577","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-45382","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}