T1543 Create or Modify System Process — Detection Rules

Source-backed rule directory

• CodeIntegrity - Blocked Image/Driver Load For Policy Violation · test · high · {"product":"windows","service":"codeintegrity-operational"}
• CodeIntegrity - Blocked Driver Load With Revoked Certificate · test · high · {"product":"windows","service":"codeintegrity-operational"}
• Service Installed By Unusual Client - Security · test · high · {"service":"security","product":"windows","definition":"Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697"}
• KrbRelayUp Service Installation · test · high · {"product":"windows","service":"system"}
• Service Installed By Unusual Client - System · test · high · {"product":"windows","service":"system"}
• PUA - Process Hacker Driver Load · test · high · {"category":"driver_load","product":"windows"}
• PUA - System Informer Driver Load · test · medium · {"category":"driver_load","product":"windows"}
• PUA - Process Hacker Execution · test · medium · {"category":"process_creation","product":"windows"}
• PUA - System Informer Execution · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1543 Create or Modify System Process

MATCH(service_created_or_modified) AND service_binary NOT_IN approved_service_binaries -> ALERT

• Service and Daemon Management Logs
• Windows System Event Logs
• Linux System Logs
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0571 Detection of System Process Creation or Modification Across Platforms

AN1575 Analytic 1575

Detects command-line or API-based creation/modification of Windows Services via `sc.exe`, `powershell.exe`, `services.exe`, or `ChangeServiceConfig`. Looks for creation/modification of autostart services via registry changes, file drops to `System32\services`, and anomalous parent-child process trees.

AN1576 Analytic 1576

Detects creation or modification of `systemd` service units, addition of cron jobs that invoke binaries on boot, or suspicious writes to `/etc/init.d/`. Monitors `chmod +x` and `systemctl` execution paths, especially from non-root parent processes.

AN1577 Analytic 1577

Detects creation or modification of `LaunchDaemon` or `LaunchAgent` plist files under `/Library/LaunchDaemons/`, `~/Library/LaunchAgents/`, or similar. Monitors execution of `launchctl`, property list edits, and file permission changes.

AN1578 Analytic 1578

Detects creation of new container system processes via `docker run --restart`, `kubectl exec` to init containers, or modification of container init specs. Flags container images that override entrypoints to embed persistence behaviors.