Create or Modify System Process

What is Create or Modify System Process?

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations are stored in the registry for Windows and in /etc/systemd for modern Linux systems. Creating or modifying system processes provides privileged, persistent execution that is difficult for standard users to remove. On macOS, launch agents and launch daemons serve similar purposes. The challenge in detecting malicious system process creation is distinguishing it from the large volume of legitimate service installations and modifications that occur during normal software lifecycle management in enterprise environments.

“Create or Modify System Process is documented as technique T1543 in the MITRE ATT&CK knowledge base under the Persistence tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Create or Modify System Process activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor Windows Registry paths HKLM\SYSTEM\CurrentControlSet\Services for new service entries and compare against authorized software inventory, alerting on services with executable paths in user-writable locations or temp directories.

2. 2

   Track changes to systemd unit files in /etc/systemd/system/ and /lib/systemd/system/ on Linux systems using file integrity monitoring, alerting on new or modified unit files that execute scripts from non-standard paths.

3. 3

   Detect service creation using unrecognized or unsigned service binaries by correlating service executable paths with known good software inventory and digital signature validation databases.

4. 4

   Monitor for services configured with unusual recovery options such as restarting with different executables on failure, which can be used to establish redundant execution mechanisms that survive if the primary service is stopped.

5. 5

   Alert on service creation or modification events occurring outside of authorized change management windows, particularly on production systems where service changes should follow a controlled deployment process.

Example Alerts

These realistic alert examples show what Create or Modify System Process looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Create or Modify System Process?

SOC analysts detect Create or Modify System Process (T1543) by monitoring XDR, SIEM telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor windows registry paths hklm\system\currentcontrolset\services for new service entries and compare against authorized software inventory, alert. SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Create or Modify System Process?

Create or Modify System Process can be detected using XDR, SIEM platforms. XDR tools are particularly effective for this technique because they provide visibility into the persistence phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Create or Modify System Process in real-world attacks?

Create or Modify System Process is a well-documented MITRE ATT&CK technique in the Persistence tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Create or Modify System Process scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Create or Modify System Process for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Persistence techniques like Create or Modify System Process. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.