T1543
Create or Modify System Process
Containers · Linux · macOS · Windows9 pieces on this siteT1543 on attack.mitre.org
Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters.
If this is happening now
Checklists and playbooks to open while the alert is still live.
How to find what an operator left behind
You have evicted somebody, or believe you have, and need to be sure there is no way back in.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma endpoint pack: seven rules for the Windows techniques that keep working
Shadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.
The evidence it leaves
Where the traces live, and what each source proves and does not.
LaunchAgents and LaunchDaemons
systemd units and timers
systemd journal
TCC privacy database
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: a service that starts before you do
Windows services run as SYSTEM and start before anyone logs in, which makes them the most valuable persistence on the box and the hardest to spot among the two hundred already there. Part three of the persistence series.
Read
Analyses, case studies, guides, references and interview questions.
Windows event log cheat sheet: by the question you are asking
Organised by what you are trying to establish rather than by number: who logged on and how, what ran, what persisted, what was tampered with. Every entry says which log, whether it is on by default, and what it does not tell you.
linux-triage.sh: a read-only first-hour collection script for Linux
One Bash file that collects processes, sockets, deleted-but-running binaries, logons, SSH keys, persistence and recent changes in order of volatility, using only what ships with a distribution. It writes text files and a SHA-256 manifest, and it is short enough to read before you run it.
how MITRE says to see it
Detection of System Process Creation or Modification Across Platforms
- Detects command-line or API-based creation/modification of Windows Services via `sc.exe`, `powershell.exe`, `services.exe`, or `ChangeServiceConfig`. Looks for creation/modification of autostart services via registry changes, file drops to `System32\services`, and anomalous parent-child process trees.
- Detects creation or modification of `systemd` service units, addition of cron jobs that invoke binaries on boot, or suspicious writes to `/etc/init.d/`. Monitors `chmod +x` and `systemctl` execution paths, especially from non-root parent processes.
- Detects creation or modification of `LaunchDaemon` or `LaunchAgent` plist files under `/Library/LaunchDaemons/`, `~/Library/LaunchAgents/`, or similar. Monitors execution of `launchctl`, property list edits, and file permission changes.
- Detects creation of new container system processes via `docker run --restart`, `kubectl exec` to init containers, or modification of container init specs. Flags container images that override entrypoints to embed persistence behaviors.
what reduces it
- M1033 Limit Software Installation. Restrict software installation to trusted repositories only and be cautious of orphaned software packages.
- M1028 Operating System Configuration. Ensure that Driver Signature Enforcement is enabled to restrict unsigned drivers from being installed.
- M1045 Code Signing. Enforce registration and execution of only legitimately signed service drivers where possible.
- M1040 Behavior Prevention on Endpoint. On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent an application from writing a signed vulnerable driver to the system. On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed drivers.
- M1018 User Account Management. Limit privileges of user accounts and groups so that only authorized administrators can interact with system-level process changes and service configurations.
- M1022 Restrict File and Directory Permissions. Restrict read/write access to system-level process files to only select privileged users who have a legitimate need to manage system services.