T1543 Create or Modify System Process

Technique: T1543
Tactics: Persistence, Privilege Escalation
Research, 90 days: 3
KEV CVEs mapped: 9
SigmaHQ rules: 9
Elastic, Splunk: 98
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1543

MITRE description

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons) Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-10-28 Cisco Talos: Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

CodeIntegrity - Blocked Image/Driver Load For Policy Violation (core)
CodeIntegrity - Blocked Driver Load With Revoked Certificate (core)
Service Installed By Unusual Client - Security (core)
KrbRelayUp Service Installation (core)
Service Installed By Unusual Client - System (core)
PUA - Process Hacker Driver Load (core)
PUA - System Informer Driver Load (core)
PUA - Process Hacker Execution (core)
PUA - System Informer Execution (core)

Elastic and Splunk rules

Node.js Pre or Post-Install Script Execution (elastic)
Modification of Persistence Relevant Files Detected via Defend for Containers (elastic)
Suspicious Echo or Printf Execution Detected via Defend for Containers (elastic)
Namespace Manipulation Using Unshare in a Container (elastic)
Potential Persistence via File Modification (elastic)
Persistence via a Hidden Plist Filename via macOS Security Events (elastic)
Launch Item Registration with Suspicious Executable Path via macOS Security Events (elastic)
Pluggable Authentication Module (PAM) Version Discovery (elastic)
Suspicious Mining Process Creation Event (elastic)
Unusual Pkexec Execution (elastic)
Suspicious APT Package Manager Execution (elastic)
APT Package Manager Configuration File Creation (elastic)
Suspicious APT Package Manager Network Connection (elastic)
Boot File Copy (elastic)
Chkconfig Service Add (elastic)
Renaming of OpenSSH Binaries (elastic)
D-Bus Service Created (elastic)
Unusual D-Bus Daemon Child Process (elastic)
DNF Package Manager Plugin File Creation (elastic)
DPKG Package Installed by Unusual Parent Process (elastic)
Unusual DPKG Execution (elastic)
Dracut Module Creation (elastic)
Initramfs Extraction via CPIO (elastic)
Git Hook Command Execution (elastic)
Git Hook Created or Modified (elastic)

Showing 25 of 98.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.