1. Home
  2. ATT&CK Techniques
  3. T1543 Create or Modify System Process

T1543 Create or Modify System Process

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons)

Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.

Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection)

View in MITRE ATT&CK®

CIS Controls Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CIS-16.7 Use Standard Hardening Configuration Templates for Application Infrastructure mitigates T1543 Create or Modify System Process
Comments
Use standard hardening templates for application infrastructure components to allowlist MIB objects and implement SNMP views, restricting access to configuration information.
References
    CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution mitigates T1543 Create or Modify System Process
    Comments
    Host-based intrusion prevention capabilities can block applications from writing signed vulnerable drivers and can enforce vulnerable-driver blocklists to reduce abuse of system processes and services.
    References
    1. https://cas.docs.cisecurity.org/en/latest/source/Controls13/#137-deploy-a-host-based-intrusion-prevention-solution
    CIS-18.3 Remediate Penetration Test Findings mitigates T1543 Create or Modify System Process
    Comments
    This relationship applies when penetration testing identifies the described software configuration weakness and the remediation restricts insecure service/process behavior.
    References
    1. https://cas.docs.cisecurity.org/en/latest/source/Controls18/#183-remediate-penetration-test-findings
    CIS-6.8 Define and Maintain Role-Based Access Control mitigates T1543 Create or Modify System Process
    Comments
    Using role-based access control (RBAC) to ensure only authorized administrator roles can interact with system-level process changes and service configurations helps prevent adversaries from leveraging this functionality to establish persistence or escalate privileges.
    References
    1. https://cas.docs.cisecurity.org/en/latest/source/Controls6/#68-define-and-maintain-role-based-access-control
    CIS-2.5 Allowlist Authorized Software mitigates T1543 Create or Modify System Process
    Comments
    Services relying on non-allowlisted binaries will fail to execute.
    References
    1. https://cas.docs.cisecurity.org/en/latest/source/Controls2/#25-allowlist-authorized-software
    CIS-2.3 Address Unauthorized Software mitigates T1543 Create or Modify System Process
    Comments
    Automated detection and removal of unauthorized installed services can directly disrupt adversary-created system services used for persistence. Enforcement reduces persistence reliability.
    References
    1. https://cas.docs.cisecurity.org/en/latest/source/Controls2/#25-allowlist-authorized-software

    VERIS Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1543 Create or Modify System Process
    action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1543 Create or Modify System Process
    action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1543 Create or Modify System Process
    action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1543 Create or Modify System Process
    action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1543 Create or Modify System Process
    action.malware.variety.Rootkit Rootkit (maintain local privileges and stealth) related-to T1543 Create or Modify System Process
    attribute.integrity.variety.Software installation Software installation or code modification related-to T1543 Create or Modify System Process

    GCP Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    google_secops Google Security Operations technique_scores T1543 Create or Modify System Process
    Comments
    Google Security Ops is able to trigger an alert based on creation or modification to system-level processes on Windows machines. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/threat_hunting/process_creation/suspicious_process_creation.yaral
    References
    1. https://cloud.google.com/security/products/security-operations
    2. https://cloud.google.com/chronicle/docs/secops/secops-overview
    3. https://github.com/chronicle/detection-rules

    AWS Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    amazon_inspector Amazon Inspector technique_scores T1543 Create or Modify System Process
    Comments
    The Amazon Inspector Best Practices assessment package can assess security control "Configure permissions for system directories" that prevents privilege escalation by local users and ensures only the root account can modify/execute system configuration information and binaries. Amazon Inspector does not directly protect against system modifications rather it just checks to see if security controls are in place which can inform decisions around hardening the system. Furthermore, Amazon Inspector only supports a subset of the sub-techniques for this technique. Due to these things and the fact the security control is only supported for Linux platforms, the score is Minimal.
    References
    1. https://docs.aws.amazon.com/inspector/latest/userguide/inspector_introduction.html

    ATT&CK Subtechniques

    Technique ID Technique Name Number of Mappings
    T1543.003 Windows Service 7
    T1543.004 Launch Daemon 4
    T1543.005 Container Service 7
    T1543.001 Launch Agent 3
    T1543.002 Systemd Service 4