T1543 — Create or Modify System Process

Technique: T1543
Tactics: Persistence, Privilege Escalation
MISP citations: 0
KEV CVEs mapped: 9
Community rules: 9
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1543

MITRE description

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons) Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection)

KEV CVEs mapped to this technique

Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.

Detection coverage

SigmaHQ community rules

CodeIntegrity - Blocked Image/Driver Load For Policy Violation (core)
CodeIntegrity - Blocked Driver Load With Revoked Certificate (core)
Service Installed By Unusual Client - Security (core)
KrbRelayUp Service Installation (core)
Service Installed By Unusual Client - System (core)
PUA - Process Hacker Driver Load (core)
PUA - System Informer Driver Load (core)
PUA - Process Hacker Execution (core)
PUA - System Informer Execution (core)

Signal counts reflect the current corpus snapshot: MISP citations are regex-extracted from CIRCL OSINT event text and galaxy tags; KEV mappings come from MITRE CTID; community coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting collections) at release r2026-04-01. Rule bodies are not mirrored — links go upstream.