T1543 Create or Modify System Process — ATT&CK Technique
Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters. Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.
Detection coverage (19)
- PUA - Process Hacker Execution medium
- PUA - System Informer Execution medium
- CodeIntegrity - Blocked Driver Load With Revoked Certificate high
- CodeIntegrity - Blocked Image/Driver Load For Policy Violation high
- Service Installed By Unusual Client - Security high
- Service Installed By Unusual Client - System high
- KrbRelayUp Service Installation high
- PUA - System Informer Driver Load medium
- PUA - Process Hacker Driver Load high
- Cisco Isovalent - Late Process Execution
- Cisco Isovalent - Nsenter Usage in Kubernetes Pod
- Cisco Isovalent - Shell Execution
- Clop Ransomware Known Service Name
- LLM Model File Creation
- MacOS Kextload Usage
- Windows Local LLM Framework Execution
- Windows Process Execution in Temp Dir
- Windows Suspicious Process File Path
- Wscript Or Cscript Suspicious Child Process