1. Home
  2. ATT&CK Techniques
  3. T1543 Create or Modify System Process

T1543 Create or Modify System Process Mappings

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. (Citation: TechNet Services) On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons)

Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.

Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges. (Citation: OSX Malware Detection).

View in MITRE ATT&CK®

NIST 800-53 Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
AC-17 Remote Access Protects T1543 Create or Modify System Process
AC-2 Account Management Protects T1543 Create or Modify System Process
AC-3 Access Enforcement Protects T1543 Create or Modify System Process
AC-5 Separation of Duties Protects T1543 Create or Modify System Process
AC-6 Least Privilege Protects T1543 Create or Modify System Process
CA-7 Continuous Monitoring Protects T1543 Create or Modify System Process
CA-8 Penetration Testing Protects T1543 Create or Modify System Process
CM-11 User-installed Software Protects T1543 Create or Modify System Process
CM-2 Baseline Configuration Protects T1543 Create or Modify System Process
CM-3 Configuration Change Control Protects T1543 Create or Modify System Process
CM-5 Access Restrictions for Change Protects T1543 Create or Modify System Process
CM-6 Configuration Settings Protects T1543 Create or Modify System Process
CM-7 Least Functionality Protects T1543 Create or Modify System Process
IA-2 Identification and Authentication (organizational Users) Protects T1543 Create or Modify System Process
IA-4 Identifier Management Protects T1543 Create or Modify System Process
RA-5 Vulnerability Monitoring and Scanning Protects T1543 Create or Modify System Process
SA-22 Unsupported System Components Protects T1543 Create or Modify System Process
SI-16 Memory Protection Protects T1543 Create or Modify System Process
SI-3 Malicious Code Protection Protects T1543 Create or Modify System Process
SI-4 System Monitoring Protects T1543 Create or Modify System Process
SI-7 Software, Firmware, and Information Integrity Protects T1543 Create or Modify System Process

Azure Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
alerts_for_windows_machines Alerts for Windows Machines technique_scores T1543 Create or Modify System Process
Comments
This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal.
References
  1. https://docs.microsoft.com/en-us/azure/security-center/defender-for-servers-introduction
  2. https://docs.microsoft.com/en-us/azure/security-center/alerts-reference#alerts-windows
azure_security_center_recommendations Azure Security Center Recommendations technique_scores T1543 Create or Modify System Process
Comments
This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can mitigate a sub-technique of this technique. Due to its Minimal coverage, its score is assessed as Minimal.
References
  1. https://docs.microsoft.com/en-us/azure/security-center/recommendations-reference
  2. https://docs.microsoft.com/en-us/azure/security-center/security-center-introduction
azure_sentinel Azure Sentinel technique_scores T1543 Create or Modify System Process
Comments
This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures.
References
  1. https://docs.microsoft.com/en-us/azure/sentinel/overview
  2. https://docs.microsoft.com/en-us/azure/sentinel/hunting
microsoft_defender_for_identity Microsoft Defender for Identity technique_scores T1543 Create or Modify System Process
Comments
This control provides minimal detection for one of this technique's sub-techniques, while not providing any detection for the remaining, resulting in a Minimal score.
References
  1. https://docs.microsoft.com/en-us/defender-for-identity/what-is
file_integrity_monitoring File Integrity Monitoring technique_scores T1543 Create or Modify System Process
Comments
References
  1. https://docs.microsoft.com/en-us/azure/security-center/security-center-file-integrity-monitoring
azure_defender_for_app_service Azure Defender for App Service technique_scores T1543 Create or Modify System Process
Comments
This control only addresses a minority of this technique's procedure examples and one of its sub-techniques resulting in an overall Minimal score.
References
  1. https://docs.microsoft.com/en-us/azure/security-center/alerts-reference
  2. https://docs.microsoft.com/en-us/azure/security-center/defender-for-app-service-introduction
  3. https://azure.microsoft.com/en-us/services/app-service/
  4. https://docs.microsoft.com/en-us/azure/security-center/defender-for-servers-introduction

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1543.001 Launch Agent 7
T1543.004 Launch Daemon 7
T1543.002 Systemd Service 18
T1543.003 Windows Service 20