Which SIEM platforms have a T1543 detection rule?

df00tech provides T1543 (Create or Modify System Process) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1543 detection?

The T1543 detection is rated high severity with medium confidence.

What are common false positives for T1543?

Common false positives for T1543 include: Legitimate software installers (MSI packages, vendor setup.exe) that register services during installation — typically identified by msiexec.exe or setup.exe as parent process; IT management tools such as SCCM, Ansible, or Puppet that create or modify services as part of configuration management workflows; Security products (EDR agents, AV engines, backup software) that install kernel-level or user-mode services during deployment or updates.

T1543

Create or Modify System Process

Q: What data sources are required to detect Create or Modify System Process (T1543)?

Detecting Create or Modify System Process requires the following data sources: Process: Process Creation, Windows Registry: Registry Key Modification, Command: Command Execution, Microsoft Defender for Endpoint.

Persistence Privilege Escalation Last updated: April 21, 2026

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters. Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.

What is T1543 Create or Modify System Process?

Create or Modify System Process (T1543) maps to the Persistence and Privilege Escalation tactics — the adversary is trying to maintain their foothold in MITRE ATT&CK.

This page provides production-ready detection logic for Create or Modify System Process, covering the data sources and telemetry it touches: Process: Process Creation, Windows Registry: Registry Key Modification, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Persistence Privilege Escalation
Technique: T1543 Create or Modify System Process
Canonical reference: https://attack.mitre.org/techniques/T1543/

Microsoft Sentinel / Defender

kusto

let SuspiciousServicePaths = dynamic([
  "\\Temp\\", "\\AppData\\", "\\Downloads\\", "\\Public\\",
  "\\Users\\Public\\", "%TEMP%", "%APPDATA%", "%PUBLIC%"
]);
let KnownLOLBins = dynamic([
  "powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe",
  "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe",
  "bitsadmin.exe", "wmic.exe", "msbuild.exe"
]);
// Branch 1: New service installation via sc.exe or PowerShell New-Service
let NewServiceCreation = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "sc.exe" and ProcessCommandLine has_any ("create", "config")
  or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("New-Service", "Set-Service", "sc.exe create"))
| extend DetectionType = "NewServiceCreation"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Branch 2: Service binary in suspicious path (registry write to Services key)
let SuspiciousServiceBinary = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services"
| where RegistryValueName =~ "ImagePath"
| where RegistryValueData has_any (SuspiciousServicePaths)
      or RegistryValueData has_any (KnownLOLBins)
| extend DetectionType = "SuspiciousServiceBinaryPath"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryKey,
          RegistryValueName, RegistryValueData, InitiatingProcessFileName,
          InitiatingProcessCommandLine, DetectionType;
// Branch 3: Service installed by unusual parent (Office apps, script interpreters)
let UnusualParentService = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "sc.exe" and ProcessCommandLine has "create"
| where InitiatingProcessFileName in~ (
    "winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
    "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe"
  )
| extend DetectionType = "ServiceCreatedByOfficeOrScript"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Branch 4: New service type 0x10 (WIN32_OWN_PROCESS) with autostart via reg
let AutostartServiceReg = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services"
| where RegistryValueName =~ "Start" and RegistryValueData in ("2", "0") // Auto or Boot
| where InitiatingProcessFileName !in~ (
    "services.exe", "svchost.exe", "msiexec.exe", "TrustedInstaller.exe",
    "WmiPrvSE.exe", "MsMpEng.exe"
  )
| extend DetectionType = "AutostartServiceRegistered"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryKey,
          RegistryValueName, RegistryValueData, InitiatingProcessFileName,
          InitiatingProcessCommandLine, DetectionType;
union NewServiceCreation, UnusualParentService
| sort by Timestamp desc

Detects creation or modification of Windows services using multiple detection branches: (1) sc.exe or PowerShell New-Service invocations, (2) suspicious ImagePath registry values pointing to writable user directories or LOLBins, (3) service creation initiated by Office applications or script interpreters, and (4) autostart service registry modifications by unexpected processes. Uses DeviceProcessEvents and DeviceRegistryEvents tables from Microsoft Defender for Endpoint.

high severity medium confidence

Data Sources

Process: Process Creation Windows Registry: Registry Key Modification Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceRegistryEvents

False Positives

Legitimate software installers (MSI packages, vendor setup.exe) that register services during installation — typically identified by msiexec.exe or setup.exe as parent process
IT management tools such as SCCM, Ansible, or Puppet that create or modify services as part of configuration management workflows
Security products (EDR agents, AV engines, backup software) that install kernel-level or user-mode services during deployment or updates
Software developers testing or deploying Windows services locally, particularly from development directories that may match suspicious path patterns
System administrators manually configuring services via sc.exe or PowerShell during maintenance windows — correlate with change management tickets

Splunk

spl

index=wineventlog (
  (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
  OR (sourcetype="WinEventLog:Security" EventCode IN (4697, 7045))
  OR (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (12, 13, 14))
)
| eval DetectionBranch=case(
    EventCode=1 AND (match(Image, "(?i)\\\\sc\.exe$") AND match(CommandLine, "(?i)(create|config)")), "sc_exe_service_create",
    EventCode=1 AND match(Image, "(?i)\\\\(powershell|pwsh)\.exe$") AND match(CommandLine, "(?i)(New-Service|Set-Service)"), "powershell_new_service",
    EventCode IN (4697, 7045), "security_service_install",
    EventCode IN (12, 13, 14) AND match(TargetObject, "(?i)SYSTEM\\\\CurrentControlSet\\\\Services"), "registry_service_modification",
    true(), null()
  )
| where isnotnull(DetectionBranch)
| eval ServiceName=case(
    EventCode=4697, mvindex(split(Message, "\n"), 0),
    EventCode=7045, ServiceName,
    EventCode=1, replace(CommandLine, ".*?(?:create|New-Service)\\s+([\\w-]+).*", "\\1"),
    EventCode IN (12,13,14), replace(TargetObject, ".*Services\\\\([^\\\\]+).*", "\\1"),
    true(), "unknown"
  )
| eval SuspiciousPath=if(
    match(coalesce(ServiceFileName, CommandLine, RegistryValueData, ""),
      "(?i)(\\\\temp\\\\|\\\\appdata\\\\|\\\\downloads\\\\|\\\\public\\\\|%temp%|%appdata%)"),
    1, 0
  )
| eval LOLBinService=if(
    match(coalesce(ServiceFileName, CommandLine, RegistryValueData, ""),
      "(?i)(powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe)"),
    1, 0
  )
| eval UnusualParent=if(
    EventCode=1 AND match(ParentImage,
      "(?i)(winword|excel|powerpnt|outlook|wscript|cscript|mshta|rundll32)\.exe"),
    1, 0
  )
| eval RiskScore=SuspiciousPath + LOLBinService + UnusualParent
| eval SuspicionFlags=mvappend(
    if(SuspiciousPath=1, "suspicious_path", null()),
    if(LOLBinService=1, "lolbin_service", null()),
    if(UnusualParent=1, "unusual_parent", null())
  )
| table _time, host, User, DetectionBranch, ServiceName, CommandLine, ParentImage, 
        ParentCommandLine, SuspiciousPath, LOLBinService, UnusualParent, RiskScore, SuspicionFlags
| sort - _time

Detects Windows service creation and modification using Security Event IDs 4697 and 7045 (service installation), Sysmon Event ID 1 for sc.exe or PowerShell invocations, and Sysmon registry events (12/13/14) targeting the Services registry key. Assigns a risk score based on suspicious binary paths (writable user directories), LOLBin usage as the service executable, and unusual parent processes. Covers both direct API-based service creation (4697/7045) and command-line-based creation (sc.exe, New-Service).

high severity medium confidence

Data Sources

Process: Process Creation Windows Registry: Registry Key Modification Windows Event Log: Security Sysmon Event IDs 1, 12, 13, 14

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational WinEventLog:Security

False Positives

Legitimate software installers (MSI packages, vendor setup.exe) that register services during installation — typically identified by msiexec.exe or setup.exe as parent process
IT management tools such as SCCM, Ansible, or Puppet that create or modify services as part of configuration management workflows
Security products (EDR agents, AV engines, backup software) that install kernel-level or user-mode services during deployment or updates
Software developers testing or deploying Windows services locally, particularly from development directories that may match suspicious path patterns
System administrators manually configuring services via sc.exe or PowerShell during maintenance windows — correlate with change management tickets

Elastic Security (EQL)

eql

sequence by host.name with maxspan=5m
  [any where event.category == "process" and
   (
     (process.name : "sc.exe" and process.args : ("create", "config")) or
     (process.name : ("powershell.exe", "pwsh.exe") and process.args : ("New-Service", "Set-Service", "sc.exe"))
   )
  ] by process.entity_id

sequence by host.name with maxspan=1m
  [process where event.type == "start" and
   process.name : "sc.exe" and process.args : "create" and
   process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
                           "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
  ]

process where event.type == "start" and
(
  (
    process.name : "sc.exe" and
    process.args : ("create", "config") and
    not process.parent.name : ("services.exe", "svchost.exe", "msiexec.exe")
  ) or
  (
    process.name : ("powershell.exe", "pwsh.exe") and
    process.args : ("New-Service", "Set-Service")
  ) or
  (
    process.name : "sc.exe" and process.args : "create" and
    process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
                            "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
  )
) or
registry where event.type in ("creation", "change") and
  registry.path : "HKLM\\SYSTEM\\CurrentControlSet\\Services\\*\\ImagePath" and
  (
    registry.data.strings : ("*\\Temp\\*", "*\\AppData\\*", "*\\Downloads\\*",
                              "*\\Public\\*", "%TEMP%*", "%APPDATA%*") or
    registry.data.strings : ("*powershell.exe*", "*cmd.exe*", "*wscript.exe*",
                              "*cscript.exe*", "*mshta.exe*", "*regsvr32.exe*",
                              "*rundll32.exe*", "*certutil.exe*", "*bitsadmin.exe*")
  ) or
registry where event.type in ("creation", "change") and
  registry.path : "HKLM\\SYSTEM\\CurrentControlSet\\Services\\*\\Start" and
  registry.data.strings : ("2", "0") and
  not process.name : ("services.exe", "svchost.exe", "msiexec.exe",
                       "TrustedInstaller.exe", "WmiPrvSE.exe", "MsMpEng.exe")

Detects creation or modification of Windows system services via sc.exe, PowerShell New-Service/Set-Service, or direct registry writes to HKLM\SYSTEM\CurrentControlSet\Services. Covers service binaries placed in suspicious paths, LOLBin-based services, services created by Office or script interpreter parents, and autostart service registrations by non-standard processes.

high severity high confidence

Data Sources

Elastic Endpoint Security Winlogbeat with Sysmon Windows Security Event Logs

Required Tables

logs-endpoint.events.process-* logs-endpoint.events.registry-* winlogbeat-*

False Positives

Legitimate software installers (MSI packages, setup.exe) frequently create services during installation — filter by process.parent.name of msiexec.exe or setup-related processes
IT administration tools such as SCCM, Ansible, or Puppet may create or modify services as part of configuration management — build allowlists for known admin tool paths and accounts
Security products (EDR agents, AV engines) routinely register autostart services during updates — whitelist known security vendor process names and signed binary paths

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  LOGSOURCENAME(logsourceid) AS log_source,
  username,
  QIDNAME(qid) AS event_name,
  EventID,
  CommandLine,
  ParentProcessPath,
  ProcessPath,
  CASE
    WHEN EventID IN (7045, 4697) THEN 'security_service_install_event'
    WHEN EventID = 1 AND CommandLine ILIKE '%sc.exe%create%' THEN 'sc_exe_service_creation'
    WHEN EventID = 1 AND (CommandLine ILIKE '%New-Service%' OR CommandLine ILIKE '%Set-Service%') THEN 'powershell_service_creation'
    WHEN EventID = 1 AND CommandLine ILIKE '%sc.exe%create%'
      AND ParentProcessPath ILIKE ANY ('%winword.exe', '%excel.exe', '%powerpnt.exe',
                                       '%wscript.exe', '%cscript.exe', '%mshta.exe', '%rundll32.exe') THEN 'unusual_parent_service_creation'
    WHEN EventID IN (12, 13) AND RegistryPath ILIKE '%CurrentControlSet\\Services%' THEN 'registry_service_modification'
    ELSE 'unknown'
  END AS detection_branch,
  CASE
    WHEN CommandLine ILIKE ANY ('%\\Temp\\%', '%\\AppData\\%', '%\\Downloads\\%',
                                '%\\Public\\%', '%TEMP%', '%APPDATA%') THEN 1
    ELSE 0
  END AS suspicious_path,
  CASE
    WHEN CommandLine ILIKE ANY ('%powershell.exe%', '%cmd.exe%', '%wscript.exe%',
                                '%cscript.exe%', '%mshta.exe%', '%rundll32.exe%',
                                '%regsvr32.exe%', '%certutil.exe%', '%bitsadmin.exe%') THEN 1
    ELSE 0
  END AS lolbin_service,
  CASE
    WHEN EventID = 1 AND ParentProcessPath ILIKE ANY
      ('%winword.exe', '%excel.exe', '%powerpnt.exe', '%outlook.exe',
       '%wscript.exe', '%cscript.exe', '%mshta.exe', '%rundll32.exe') THEN 1
    ELSE 0
  END AS unusual_parent
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 13, 14, 397)  -- Windows Security, Sysmon, System
  AND (
    EventID IN (7045, 4697)
    OR (
      EventID = 1 AND (
        (CommandLine ILIKE '%sc.exe%' AND (CommandLine ILIKE '%create%' OR CommandLine ILIKE '%config%'))
        OR (CommandLine ILIKE '%powershell%' AND (CommandLine ILIKE '%New-Service%' OR CommandLine ILIKE '%Set-Service%'))
      )
    )
    OR (
      EventID IN (12, 13) AND
      RegistryPath ILIKE '%SYSTEM\\CurrentControlSet\\Services%' AND
      (
        RegistryPath ILIKE '%ImagePath%' OR
        RegistryPath ILIKE '%\\Start'
      )
    )
  )
  AND (
    suspicious_path = 1 OR lolbin_service = 1 OR unusual_parent = 1 OR EventID IN (7045, 4697)
  )
ORDER BY starttime DESC
LAST 24 HOURS

Detects Windows service creation and modification events using QRadar AQL against Windows Security Event Log (EventIDs 7045, 4697), Sysmon process creation (EventID 1 with sc.exe or PowerShell), and Sysmon registry events (EventIDs 12/13) targeting the Services registry hive. Scores events by suspicious path, LOLBin usage, and unusual parent process.

high severity high confidence

Data Sources

Windows Security Event Log Sysmon Operational Log Windows System Event Log

Required Tables

events

False Positives

Software deployment systems (SCCM, PDQ Deploy, Chocolatey) routinely create services — correlate with known software deployment windows and authorized maintenance accounts
Security monitoring agents (CrowdStrike Falcon, Cylance, Carbon Black) update their own services and may trigger registry modification alerts — build exclusions for signed binaries from known security vendors
Development and testing environments may have developers creating test services via PowerShell New-Service — separate production and non-production log source groups

Sumo Logic CSE

sql

_sourceCategory=windows* AND (
  ("EventCode=7045" OR "EventCode=4697") OR
  ("EventCode=1" AND ("sc.exe" AND ("create" OR "config"))) OR
  ("EventCode=1" AND ("New-Service" OR "Set-Service")) OR
  ("EventCode=12" OR "EventCode=13") AND "CurrentControlSet\Services"
)
| parse "EventCode=*" as EventCode
| parse regex "(?i)CommandLine=(?P<CommandLine>[^\n]+)" nodrop
| parse regex "(?i)ParentImage=(?P<ParentImage>[^\n]+)" nodrop
| parse regex "(?i)Image=(?P<Image>[^\n]+)" nodrop
| parse regex "(?i)TargetObject=(?P<RegistryKey>[^\n]+)" nodrop
| parse regex "(?i)ServiceFileName=(?P<ServiceFileName>[^\n]+)" nodrop
| parse regex "(?i)User=(?P<User>[^\n]+)" nodrop
| parse regex "(?i)Computer=(?P<Computer>[^\n]+)" nodrop
| eval DetectionBranch = if(EventCode in ("7045", "4697"), "security_service_install",
  if(EventCode == "1" and matches(CommandLine, "(?i)sc\.exe") and matches(CommandLine, "(?i)(create|config)"), "sc_exe_service_create",
  if(EventCode == "1" and matches(CommandLine, "(?i)(New-Service|Set-Service)"), "powershell_new_service",
  if((EventCode == "12" or EventCode == "13") and matches(RegistryKey, "(?i)CurrentControlSet.Services"), "registry_service_modification",
  "other"))))
| where DetectionBranch != "other"
| eval SuspiciousPath = if(
    matches(coalesce(ServiceFileName, CommandLine, ""), "(?i)(\\\\temp\\\\|\\\\appdata\\\\|\\\\downloads\\\\|\\\\public\\\\|%temp%|%appdata%)"),
    1, 0)
| eval LOLBinService = if(
    matches(coalesce(ServiceFileName, CommandLine, ""), "(?i)(powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe)"),
    1, 0)
| eval UnusualParent = if(
    EventCode == "1" and matches(ParentImage, "(?i)(winword|excel|powerpnt|outlook|wscript|cscript|mshta|rundll32)\.exe"),
    1, 0)
| eval RiskScore = SuspiciousPath + LOLBinService + UnusualParent
| eval SuspicionFlags = concat(
    if(SuspiciousPath == 1, "suspicious_path ", ""),
    if(LOLBinService == 1, "lolbin_service ", ""),
    if(UnusualParent == 1, "unusual_parent ", "")
  )
| where RiskScore > 0 or DetectionBranch == "security_service_install"
| fields _messageTime, Computer, User, DetectionBranch, CommandLine, Image, ParentImage, ServiceFileName, RegistryKey, RiskScore, SuspicionFlags
| sort by _messageTime desc

Detects Windows service creation and modification via Sumo Logic CSE by parsing Sysmon and Windows Security event logs. Identifies sc.exe service creation, PowerShell New-Service/Set-Service usage, direct registry modifications to the Services hive, and security audit events 7045/4697. Scores results by suspicious binary path, LOLBin usage, and abnormal parent processes.

high severity high confidence

Data Sources

Windows Security Event Log Sysmon Operational Log via Sumo Logic Installed Collector

Required Tables

_sourceCategory=windows*

False Positives

Windows Update and patch management processes (TiWorker.exe, TrustedInstaller.exe) create and modify services during OS updates — filter by known Windows Update process names and system accounts
Virtualization software (VMware Tools, VirtualBox Guest Additions) creates services during installation and updates — allowlist known vendor-signed process paths
Custom enterprise monitoring agents deployed by IT operations may trigger registry modification detections — coordinate with IT ops for known deployment accounts and time windows

Google Chronicle / SecOps

yaral

rule t1543_create_modify_system_process {
  meta:
    author = "Detection Engineering"
    description = "Detects creation or modification of Windows system services via sc.exe, PowerShell, or direct registry writes to CurrentControlSet\\Services. Covers LOLBin-based services, suspicious binary paths, and unusual parent process chains."
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1543"
    mitre_attack_subtechnique = "T1543.003"
    severity = "HIGH"
    priority = "HIGH"

  events:
    // Branch 1: sc.exe or PowerShell service creation
    $e1.metadata.event_type = "PROCESS_LAUNCH"
    $e1.principal.hostname = $hostname
    (
      (
        re.regex($e1.target.process.file.full_path, `(?i)\\sc\.exe$`) and
        re.regex($e1.target.process.command_line, `(?i)(create|config)`)
      ) or
      (
        re.regex($e1.target.process.file.full_path, `(?i)\\(powershell|pwsh)\.exe$`) and
        re.regex($e1.target.process.command_line, `(?i)(New-Service|Set-Service)`)
      )
    )

  condition:
    $e1
}

rule t1543_service_registry_modification {
  meta:
    author = "Detection Engineering"
    description = "Detects suspicious registry modifications to HKLM\\SYSTEM\\CurrentControlSet\\Services including ImagePath set to suspicious locations or LOLBin executables, and autostart (Start=2/0) values written by non-system processes."
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1543"
    mitre_attack_subtechnique = "T1543.003"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e2.metadata.event_type = "REGISTRY_MODIFICATION"
    $e2.principal.hostname = $hostname
    re.regex($e2.target.registry.registry_key, `(?i)HKLM\\SYSTEM\\CurrentControlSet\\Services`)
    (
      (
        $e2.target.registry.registry_value_name = "ImagePath" and
        (
          re.regex($e2.target.registry.registry_value_data, `(?i)(\\temp\\|\\appdata\\|\\downloads\\|\\public\\|%temp%|%appdata%)`) or
          re.regex($e2.target.registry.registry_value_data, `(?i)(powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe)`)
        )
      ) or
      (
        $e2.target.registry.registry_value_name = "Start" and
        $e2.target.registry.registry_value_data in ("2", "0") and
        not re.regex($e2.principal.process.file.full_path, `(?i)(services\.exe|svchost\.exe|msiexec\.exe|TrustedInstaller\.exe|WmiPrvSE\.exe|MsMpEng\.exe)`)
      )
    )

  condition:
    $e2
}

rule t1543_service_unusual_parent {
  meta:
    author = "Detection Engineering"
    description = "Detects sc.exe service creation invoked by Office applications or script interpreters, indicating possible macro or script-based lateral movement/persistence."
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1543"
    mitre_attack_subtechnique = "T1543.003"
    severity = "CRITICAL"
    priority = "CRITICAL"

  events:
    $e3.metadata.event_type = "PROCESS_LAUNCH"
    $e3.principal.hostname = $hostname
    re.regex($e3.target.process.file.full_path, `(?i)\\sc\.exe$`)
    re.regex($e3.target.process.command_line, `(?i)create`)
    re.regex($e3.principal.process.file.full_path,
      `(?i)(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe)`)

  condition:
    $e3
}

Three YARA-L 2.0 rules detecting T1543 service persistence: (1) sc.exe or PowerShell service creation, (2) suspicious registry writes to the Services hive (LOLBin ImagePath or autostart entries by non-system processes), (3) sc.exe service creation from Office applications or script interpreters. Rules use UDM process and registry event types with regex matching on command lines and registry paths.

high severity high confidence

Data Sources

Google Chronicle UDM Windows Event Logs via Chronicle Forwarder Sysmon via Chronicle Forwarder

Required Tables

PROCESS_LAUNCH REGISTRY_MODIFICATION

False Positives

Enterprise software deployment pipelines (Intune, SCCM) create services as part of managed application installs — apply reference list exclusions for known MDM/deployment system hostnames and service accounts
Development workstations where developers test service-based applications via PowerShell New-Service — scope detection to production and server asset groups, or reduce severity for developer workstation segments
Backup and recovery software (Veeam, Acronis, Veritas) installs services via MSI with PowerShell wrappers — allowlist known backup agent binary hashes or signing certificate subjects

CrowdStrike LogScale (CQL)

cql

// Branch 1: sc.exe or PowerShell service creation
#event_simpleName=ProcessRollup2
| FileName in ("sc.exe", "powershell.exe", "pwsh.exe")
| CommandLine = /(?i)(sc\.exe.*(create|config)|New-Service|Set-Service)/
| NOT ParentBaseFileName in ("services.exe", "svchost.exe", "msiexec.exe", "TrustedInstaller.exe")
| eval DetectionBranch = case(
    FileName == "sc.exe" AND CommandLine =~ /(?i)(create|config)/, "sc_exe_service_create",
    FileName =~ /(?i)(powershell|pwsh)\.exe/ AND CommandLine =~ /(?i)(New-Service|Set-Service)/, "powershell_new_service",
    true, "other"
  )
| eval SuspiciousPath = if(
    CommandLine =~ /(?i)(\\temp\\|\\appdata\\|\\downloads\\|\\public\\|%temp%|%appdata%)/, 1, 0
  )
| eval LOLBinService = if(
    CommandLine =~ /(?i)(powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe)/, 1, 0
  )
| eval UnusualParent = if(
    ParentBaseFileName =~ /(?i)(winword|excel|powerpnt|outlook|wscript|cscript|mshta|rundll32)\.exe/, 1, 0
  )
| eval RiskScore = SuspiciousPath + LOLBinService + UnusualParent
| where DetectionBranch != "other" AND (RiskScore > 0 OR UnusualParent == 1)
| select timestamp, ComputerName, UserName, DetectionBranch, FileName, CommandLine,
         ParentBaseFileName, ParentCommandLine, RiskScore, SuspiciousPath, LOLBinService, UnusualParent

// Branch 2: Registry modifications to Services hive (run as separate saved search)
// #event_simpleName=RegGenericValueUpdate OR #event_simpleName=RegistryKeyCreate
// | RegObjectName = /(?i)SYSTEM\\CurrentControlSet\\Services/
// | RegValueName in~ ("ImagePath", "Start")
// | NOT RegOperationValue in ("services.exe", "svchost.exe", "msiexec.exe",
//                             "TrustedInstaller.exe", "WmiPrvSE.exe", "MsMpEng.exe")
// | eval SuspiciousImagePath = if(
//     RegStringValue =~ /(?i)(\\temp\\|\\appdata\\|\\downloads\\|\\public\\|%temp%|%appdata%|
//                          powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|
//                          rundll32\.exe|regsvr32\.exe|certutil\.exe)/, 1, 0
//   )
// | where SuspiciousImagePath == 1 OR (RegValueName =~ "Start" AND RegStringValue in ("2", "0"))
// | select timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, ContextProcessName

| groupBy([ComputerName, UserName, DetectionBranch, CommandLine, ParentBaseFileName], function=(
    count(aid, as=EventCount),
    max(RiskScore, as=MaxRiskScore),
    collect([SuspiciousPath, LOLBinService, UnusualParent])
  ))
| sort(MaxRiskScore, order=desc)

Detects Windows service creation and modification via CrowdStrike LogScale (Falcon Insight) using ProcessRollup2 events. Identifies sc.exe service creation, PowerShell New-Service/Set-Service invocations, LOLBin-based service binaries, suspicious service binary paths (Temp/AppData/Downloads), and service creation by Office applications or script interpreters. Registry-based detection is provided as a commented branch using RegGenericValueUpdate events.

high severity high confidence

Data Sources

CrowdStrike Falcon Insight EDR Falcon Process Telemetry Falcon Registry Telemetry

Required Tables

ProcessRollup2 RegGenericValueUpdate RegistryKeyCreate

False Positives

Automated patching and software lifecycle management tools (Tanium, BigFix, Ivanti) execute sc.exe during service configuration — build suppression rules for known patch management tool hashes and approved service account names
Container orchestration platforms (Docker Desktop for Windows, Kubernetes node services) create system services during startup and updates — exclude known container runtime binary paths from detection scope
Internal IT scripting automation using PowerShell DSC or custom onboarding scripts may invoke New-Service — coordinate with IT teams to identify scheduled maintenance windows and approved scripts for tuning

Sigma rule & cross-platform mapping

The detection logic for Create or Modify System Process (T1543) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1543 Sigma rules on detection.fyi

Platform-specific guides for T1543

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-21 Research depth: deep

References (8)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Create Malicious Windows Service via sc.exe
Expected signal: Security Event ID 4697 and System Event ID 7045: New service 'ArgusTestSvc' installed with ServiceFileName containing cmd.exe. Sysmon Event ID 1: sc.exe process creation with CommandLine containing 'create ArgusTestSvc'. Sysmon Event ID 13: Registry value set at HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestSvc\ImagePath.
Test 2Create Persistent Service via PowerShell New-Service
Expected signal: Sysmon Event ID 1: powershell.exe process creation with CommandLine containing 'New-Service'. Security Event ID 4697 and System Event ID 7045: service 'ArgusTestPSSvc' installed with ServiceFileName = powershell.exe. Sysmon Event ID 13: registry modification at HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestPSSvc\.
Test 3Service Installed in User-Writable Path
Expected signal: Sysmon Event ID 11: file created at %TEMP%\svchost32.exe (copy of cmd.exe). Sysmon Event ID 1: sc.exe execution with TEMP path in command line. Security Event ID 4697 / System Event ID 7045: new service with ServiceFileName in user Temp directory. Sysmon Event ID 13: ImagePath registry value containing \Temp\ path.
Test 4Modify Existing Service Binary Path (Service Hijacking)
Expected signal: Sysmon Event ID 1: sc.exe with 'config' and 'binPath' in command line targeting 'wuauserv'. Sysmon Event ID 13: registry value modification at HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\ImagePath. Security Event ID 4697 may fire depending on Windows version and audit policy. Note: this test modifies a real service — run only in isolated test environments.

Response Playbook

Triage

Identify the service name and binary path — examine the sc.exe command line, Event ID 4697/7045 ServiceFileName field, or the ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>
Check the binary location: is it in a system directory (C:\Windows\System32, C:\Program Files) or a user-writable location (Temp, AppData, Downloads, Public)? User-writable paths are high-confidence malicious indicators
Identify the creating process and its parent — who invoked sc.exe or the service creation API? Was it an Office application, script interpreter, or an unrecognized process? Compare against known software installers and IT management tools
Check the service start type: is it set to Automatic (2) or Boot (0)? Auto-start combined with a suspicious binary path is a critical indicator; Manual-start services are lower priority
Examine the service's Run As account — is it running as LocalSystem (NT AUTHORITY\SYSTEM), LocalService, NetworkService, or a specific user account? SYSTEM privileges from a user-installed service are suspicious
Look up the service binary hash against threat intelligence — calculate the SHA256 of the binary at the ImagePath and check VirusTotal or your internal hash reputation database
Check the timestamp: was the service created during business hours, off-hours, or during a known maintenance window? Correlate with change management records
Review process lineage for the creator — trace back through parent/grandparent processes to find the ultimate origin (e.g., browser download, email attachment, lateral movement from another host)

Containment

If the service binary is in a user-writable path and verified malicious: immediately stop the service (sc stop <ServiceName>), disable it (sc config <ServiceName> start= disabled), and isolate the endpoint via EDR isolation or network VLAN change
If a service account was created or modified as part of this technique: disable the service account in Active Directory, revoke all active sessions and Kerberos tickets (klist purge on affected hosts), and reset the account password
If the service binary downloaded from an external URL: block the source domain/IP at firewall, proxy, and DNS levels to prevent reinfection and identify other hosts that contacted the same URL
If lateral movement is suspected: identify other hosts running the same service binary (via hash matching in EDR), isolate all affected endpoints before the threat can propagate further
Delete the malicious service binary from disk after taking a forensic copy for analysis — preserve hash, timestamps, and a full memory dump if the service is still running
Remove the service registry keys: HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName> — verify removal and check for persistence in HKLM\SYSTEM\ControlSet001\Services\ and ControlSet002\Services\ as well

Evidence Collection

Windows Security Event Log: Event ID 4697 (A service was installed in the system) — contains ServiceName, ServiceFileName, ServiceType, ServiceStartType, ServiceAccount
Windows System Event Log: Event ID 7045 (New Service Installed) — contains ServiceName, ServiceFileName, ServiceType, ServiceStartType, ServiceAccount, logged by the Service Control Manager
Sysmon Event ID 1: Process Creation for sc.exe, powershell.exe invoking New-Service, or the service binary itself launching — captures full command line and parent process
Sysmon Event IDs 12/13/14: Registry key creation, value set, and key rename events targeting HKLM\SYSTEM\CurrentControlSet\Services\ — captures direct registry manipulation by service installation tools
Registry export: HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName> — full service configuration including ImagePath, DisplayName, ObjectName (Run As account), Start, Type
File system artifacts: Binary at the ImagePath location — collect full copy, SHA256 hash, PE metadata (compilation timestamp, imports, exports, signed/unsigned status)
File system: C:\Windows\Prefetch\<SERVICENAME>.EXE-*.pf — execution timestamps and loaded DLLs
Memory dump: If service is running, capture a full process memory dump using ProcDump or Task Manager before stopping the service — may reveal in-memory payloads injected into the service process

Escalation Criteria

! Service binary located in a user-writable directory (Temp, AppData, Downloads) rather than standard program directories — this is a near-certain indicator of malicious installation
! Service binary is a known LOLBin (powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe) — legitimate services do not use these as their primary executable
! Service created by or from a document application (Word, Excel, Outlook) or browser — indicates exploitation of a document-based initial access vector
! Service binary is unsigned or signed with an untrusted/self-signed certificate — legitimate enterprise software is consistently code-signed by recognized vendors
! Service account is a newly created domain account with elevated privileges, or the service runs as SYSTEM with no corresponding vendor documentation
! Evidence of the same service binary hash observed on multiple endpoints within a short time window — indicates automated lateral movement or worm-like propagation
! Service binary makes outbound network connections to external IPs or domains after starting — indicates active C2 communication from the newly installed service

Investigation Guide

Forensic Artifacts

> Registry: HKLM\SYSTEM\CurrentControlSet\Services\ — complete service configuration; compare against known-good baseline to identify new or modified services
> Registry: HKLM\SYSTEM\ControlSet001\Services\ and ControlSet002\Services\ — shadow copies of service configuration; malware may create entries in alternate ControlSets
> Event Log: System — Event ID 7045 (Service Control Manager) for new service installations; Event ID 7034/7035/7036 for service state changes
> Event Log: Security — Event ID 4697 for service installation; Event ID 4674 for privilege use during service creation
> File System: Service binary at ImagePath location — full PE with compilation timestamp, import table, digital signature
> File System: C:\Windows\System32\drivers\etc\ — check for unauthorized driver files if service is a kernel driver (Type=1)
> File System: C:\Windows\Prefetch\ — prefetch files for the service executable contain first/last execution timestamps and loaded modules
> WMI: Win32_Service class — query all installed services with StartMode, PathName, State, StartName for anomaly detection
> Amcache.hve: Records first execution of service binaries with hash, compilation time, and file metadata even after binary deletion

Tuning Guidance

Begin by building a baseline of legitimate services in your environment using Win32_Service WMI queries or DeviceRegistryEvents over a 30-day historical window. Create an allowlist of known-good service names, binary paths, and creating processes (msiexec.exe, specific vendor installers). The most effective tuning strategy is to exclude services whose binary path begins with C:\Program Files, C:\Program Files (x86), or C:\Windows — these account for the vast majority of legitimate software. Alert only on services with binaries in user-writable paths or using LOLBins as executables. For sc.exe detections, exclude invocations from known IT management tools by filtering on the initiating process path (e.g., C:\Program Files\Microsoft Configuration Manager\). Security Event IDs 4697 and 7045 are the most reliable source with lowest false positive rate — prioritize these over registry-based detection. Increase confidence thresholds by requiring at least two of: suspicious binary path, LOLBin executable, unusual parent process, or off-hours creation time. Sysmon-based registry event monitoring (EventCode 12/13) is noisier during software installation periods; consider suppressing during known maintenance windows identified via CMDB integration.

Hunting Queries

Hunt for service ImagePath registry modifications by unexpected processes, particularly those writing binaries in user-writable directories or registering LOLBins as service executables. Excludes known legitimate service managers. High LOLBinCount or UserPathCount strongly indicates malicious service installation.

Hunting — KQL

kql

DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has "CurrentControlSet\\Services"
| where RegistryValueName =~ "ImagePath"
| where InitiatingProcessFileName !in~ (
    "services.exe", "svchost.exe", "msiexec.exe", "TrustedInstaller.exe",
    "WmiPrvSE.exe", "MsMpEng.exe", "SYSTEM"
  )
| extend IsUserPath = RegistryValueData has_any (
    "\\Users\\", "\\Temp\\", "\\AppData\\", "\\Downloads\\", "\\Public\\"
  )
| extend IsLOLBin = RegistryValueData has_any (
    "powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe"
  )
| summarize ServiceCount=count(), 
            Services=make_set(RegistryKey), 
            Binaries=make_set(RegistryValueData),
            UserPathCount=countif(IsUserPath),
            LOLBinCount=countif(IsLOLBin)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| where UserPathCount > 0 or LOLBinCount > 0 or ServiceCount > 3
| sort by LOLBinCount desc, UserPathCount desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (12, 13)
TargetObject="*CurrentControlSet\\Services*" ValueName="ImagePath"
NOT (Image="*\\services.exe" OR Image="*\\msiexec.exe" OR Image="*\\TrustedInstaller.exe" OR Image="*\\svchost.exe")
| eval IsUserPath=if(match(Details, "(?i)(\\\\users\\\\|\\\\temp\\\\|\\\\appdata\\\\|\\\\downloads\\\\|\\\\public\\\\)"), 1, 0)
| eval IsLOLBin=if(match(Details, "(?i)(powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe)"), 1, 0)
| stats count as Changes, values(TargetObject) as Services, values(Details) as Binaries,
        sum(IsUserPath) as UserPathCount, sum(IsLOLBin) as LOLBinCount
  by host, Image, User
| where UserPathCount > 0 OR LOLBinCount > 0 OR Changes > 3
| sort - LOLBinCount, - UserPathCount

Hunt for high-frequency sc.exe service creation or configuration activity — more than 5 sc.exe commands in a single hour on one host. This pattern indicates automated service installation by malware or a deployment tool modifying multiple services rapidly, which differs from normal one-off administrative service creation.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "sc.exe"
| where ProcessCommandLine has_any ("create", "config", "failure", "binpath")
| summarize Count=count(),
            Commands=make_set(ProcessCommandLine),
            Parents=make_set(InitiatingProcessFileName),
            Accounts=make_set(AccountName)
  by DeviceName, bin(Timestamp, 1h)
| where Count > 5
| sort by Count desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
Image="*\\sc.exe" (CommandLine="*create*" OR CommandLine="*config*" OR CommandLine="*binpath*")
| bin _time span=1h
| stats count as Count, values(CommandLine) as Commands, values(ParentImage) as Parents, values(User) as Accounts
  by host, _time
| where Count > 5
| sort - Count

Hunt for newly registered services where the service binary was not observed being created on disk in the same time window — this can indicate the binary was dropped via a mechanism not captured by file events (e.g., direct disk writes, extracted from an archive, or copied from a remote share) or that the service references a binary path that doesn't exist yet (staging for future execution).

Hunting — KQL

kql

// Find services whose binary does not exist on disk or is newly created
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has "CurrentControlSet\\Services"
| where RegistryValueName =~ "ImagePath"
| extend CleanPath = replace_string(RegistryValueData, "\"", "")
| extend CleanPath = replace_string(CleanPath, "\\??\\", "")
| join kind=leftanti (
    DeviceFileEvents
    | where Timestamp > ago(7d)
    | where ActionType in ("FileCreated", "FileModified")
    | project DeviceName, FolderPath, FileName,
              FullPath = strcat(FolderPath, "\\", FileName)
  ) on DeviceName, $left.CleanPath == $right.FullPath
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, 
          InitiatingProcessFileName, InitiatingProcessAccountName

Hunting — SPL

spl

index=wineventlog sourcetype="WinEventLog:Security" EventCode IN (4697, 7045)
| eval ServiceBinary=coalesce(ServiceFileName, param3)
| eval ServiceBinary=replace(ServiceBinary, "^\"", "")
| eval ServiceBinary=replace(ServiceBinary, "\"$", "")
| join type=left ServiceBinary [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  | eval FullPath=strcat(TargetDirectory, "\\", TargetFilename)
  | stats count by FullPath
  | rename FullPath as ServiceBinary ]
| where isnull(count)
| table _time, host, ServiceName, ServiceBinary, ServiceAccount, ServiceStartType
| sort - _time

Atomic Red Team Tests

Test 1 Create Malicious Windows Service via sc.exe

windows

Creates a new Windows service using sc.exe with cmd.exe as the service binary — a LOLBin pattern commonly used by malware including Akira ransomware and various APT groups. The service is configured for auto-start, simulating persistence establishment. The service binary path points to cmd.exe with a benign command to avoid actual execution harm.

Command

powershell

sc.exe create ArgusTestSvc binPath= "cmd.exe /c echo T1543 test > %TEMP%\argus_t1543.txt" start= auto DisplayName= "Argus Test Service"

Cleanup

powershell

sc.exe stop ArgusTestSvc 2>nul; sc.exe delete ArgusTestSvc 2>nul; del %TEMP%\argus_t1543.txt 2>nul

Expected Telemetry

Security Event ID 4697 and System Event ID 7045: New service 'ArgusTestSvc' installed with ServiceFileName containing cmd.exe. Sysmon Event ID 1: sc.exe process creation with CommandLine containing 'create ArgusTestSvc'. Sysmon Event ID 13: Registry value set at HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestSvc\ImagePath.

Expected Detection

KQL Branch 1 fires on sc.exe with 'create' in command line. SPL DetectionBranch='sc_exe_service_create'. LOLBinService=1 (cmd.exe as binary). RiskScore elevated due to LOLBin usage.

Test 2 Create Persistent Service via PowerShell New-Service

windows

Uses PowerShell's New-Service cmdlet to register a new Windows service, an alternative to sc.exe used by PowerShell-based post-exploitation frameworks. Sets start type to Automatic for persistence. The binary path uses PowerShell itself as the service executable — a pattern seen in real-world malware.

Command

powershell

powershell.exe -Command "New-Service -Name 'ArgusTestPSSvc' -BinaryPathName 'powershell.exe -NoProfile -WindowStyle Hidden -Command Write-Output T1543' -StartupType Automatic -DisplayName 'Argus Test PS Service'"

Cleanup

powershell

powershell.exe -Command "Stop-Service ArgusTestPSSvc -ErrorAction SilentlyContinue; (Get-WmiObject Win32_Service -Filter \"Name='ArgusTestPSSvc'\").Delete()"

Expected Telemetry

Sysmon Event ID 1: powershell.exe process creation with CommandLine containing 'New-Service'. Security Event ID 4697 and System Event ID 7045: service 'ArgusTestPSSvc' installed with ServiceFileName = powershell.exe. Sysmon Event ID 13: registry modification at HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestPSSvc\.

Expected Detection

KQL Branch 1 fires on PowerShell with 'New-Service' in command line. SPL DetectionBranch='powershell_new_service'. LOLBinService=1 (powershell.exe as binary). Both KQL and SPL register high-risk indicators.

Test 3 Service Installed in User-Writable Path

windows

Registers a service with its binary in the user's TEMP directory — a strong indicator of malicious service installation since legitimate software virtually never places service binaries in Temp. Simulates the pattern used by IMAPLoader and similar malware that drop payloads in user directories before registering as services.

Command

powershell

copy C:\Windows\System32\cmd.exe %TEMP%\svchost32.exe && sc.exe create ArgusTempSvc binPath= "%TEMP%\svchost32.exe /c echo persistence" start= auto

Cleanup

powershell

sc.exe stop ArgusTempSvc 2>nul; sc.exe delete ArgusTempSvc 2>nul; del %TEMP%\svchost32.exe 2>nul

Expected Telemetry

Sysmon Event ID 11: file created at %TEMP%\svchost32.exe (copy of cmd.exe). Sysmon Event ID 1: sc.exe execution with TEMP path in command line. Security Event ID 4697 / System Event ID 7045: new service with ServiceFileName in user Temp directory. Sysmon Event ID 13: ImagePath registry value containing \Temp\ path.

Expected Detection

KQL SuspiciousServiceBinary fires on ImagePath registry value containing \Temp\. KQL Branch 1 fires on sc.exe create. SPL SuspiciousPath=1, RiskScore elevated. High-confidence alert due to user-writable binary path.

Test 4 Modify Existing Service Binary Path (Service Hijacking)

windows

Modifies an existing non-critical service's ImagePath to point to a different executable — simulating service binary hijacking where attackers replace or redirect legitimate service executables. Uses the Windows built-in 'browser' service (or an equivalent placeholder) as the target. This technique is used by threat actors to blend in with existing service names while executing malicious code.

Command

powershell

sc.exe config wuauserv binPath= "cmd.exe /c echo hijacked > %TEMP%\hijack_test.txt"

Cleanup

powershell

sc.exe config wuauserv binPath= "C:\Windows\System32\svchost.exe -k netsvcs -p"; del %TEMP%\hijack_test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: sc.exe with 'config' and 'binPath' in command line targeting 'wuauserv'. Sysmon Event ID 13: registry value modification at HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\ImagePath. Security Event ID 4697 may fire depending on Windows version and audit policy. Note: this test modifies a real service — run only in isolated test environments.

Expected Detection

KQL Branch 1 fires on sc.exe with 'config' in command line. KQL SuspiciousServiceBinary fires on ImagePath registry modification with cmd.exe and TEMP path. SPL DetectionBranch='sc_exe_service_create' (covers both create and config). LOLBinService=1, SuspiciousPath=1, RiskScore=2.

Related Detections

Tactic Hubs

TA0003Persistence TA0004Privilege Escalation

What is T1543 Create or Modify System Process?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1543

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Sub-techniques (5)

Related Techniques

Same Tactic: Persistence

Popular Detections

Get new detections in your inbox