THREATNOIR
Subscribe
MITRE ATT&CK · T1543

Create or Modify System Process

MITRE · cited in 13 of our lessons

Explanation

What attackers do. Attackers create or change system-level processes, such as Windows services, Linux systemd units or macOS launch daemons, so their code starts automatically with high privileges. This serves Persistence and Privilege Escalation.

How to defend. Restrict who can create or modify services, and protect service configuration and binary paths with proper permissions. Collect service creation and modification events and monitor configuration directories for system daemons. Baseline normal services so new ones stand out.

Signs to look for. Look for new services with unusual names or binary paths in user-writable folders, services pointing to scripts or command interpreters, and changes to existing service binaries. A common gap is software installations creating so many services that malicious ones are ignored.

Open the technique on MITRE ATT&CK
The official text
Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters. Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 13.