Which SIEM platforms have a T1543 detection rule?

df00tech provides T1543 (Create or Modify System Process) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Create or Modify System Process (T1543)?

Detecting Create or Modify System Process requires the following data sources: Process: Process Creation, Windows Registry: Registry Key Modification, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1543 detection?

The T1543 detection is rated high severity with medium confidence.

What are common false positives for T1543?

Common false positives for T1543 include: Legitimate software installers (MSI packages, vendor setup.exe) that register services during installation — typically identified by msiexec.exe or setup.exe as parent process; IT management tools such as SCCM, Ansible, or Puppet that create or modify services as part of configuration management workflows; Security products (EDR agents, AV engines, backup software) that install kernel-level or user-mode services during deployment or updates.

T1543 IBM QRadar · QRadar

Detect Create or Modify System Process in IBM QRadar

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters. Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.

MITRE ATT&CK

Tactic: Persistence Privilege Escalation
Technique: T1543 Create or Modify System Process
Canonical reference: https://attack.mitre.org/techniques/T1543/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  LOGSOURCENAME(logsourceid) AS log_source,
  username,
  QIDNAME(qid) AS event_name,
  EventID,
  CommandLine,
  ParentProcessPath,
  ProcessPath,
  CASE
    WHEN EventID IN (7045, 4697) THEN 'security_service_install_event'
    WHEN EventID = 1 AND CommandLine ILIKE '%sc.exe%create%' THEN 'sc_exe_service_creation'
    WHEN EventID = 1 AND (CommandLine ILIKE '%New-Service%' OR CommandLine ILIKE '%Set-Service%') THEN 'powershell_service_creation'
    WHEN EventID = 1 AND CommandLine ILIKE '%sc.exe%create%'
      AND ParentProcessPath ILIKE ANY ('%winword.exe', '%excel.exe', '%powerpnt.exe',
                                       '%wscript.exe', '%cscript.exe', '%mshta.exe', '%rundll32.exe') THEN 'unusual_parent_service_creation'
    WHEN EventID IN (12, 13) AND RegistryPath ILIKE '%CurrentControlSet\\Services%' THEN 'registry_service_modification'
    ELSE 'unknown'
  END AS detection_branch,
  CASE
    WHEN CommandLine ILIKE ANY ('%\\Temp\\%', '%\\AppData\\%', '%\\Downloads\\%',
                                '%\\Public\\%', '%TEMP%', '%APPDATA%') THEN 1
    ELSE 0
  END AS suspicious_path,
  CASE
    WHEN CommandLine ILIKE ANY ('%powershell.exe%', '%cmd.exe%', '%wscript.exe%',
                                '%cscript.exe%', '%mshta.exe%', '%rundll32.exe%',
                                '%regsvr32.exe%', '%certutil.exe%', '%bitsadmin.exe%') THEN 1
    ELSE 0
  END AS lolbin_service,
  CASE
    WHEN EventID = 1 AND ParentProcessPath ILIKE ANY
      ('%winword.exe', '%excel.exe', '%powerpnt.exe', '%outlook.exe',
       '%wscript.exe', '%cscript.exe', '%mshta.exe', '%rundll32.exe') THEN 1
    ELSE 0
  END AS unusual_parent
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 13, 14, 397)  -- Windows Security, Sysmon, System
  AND (
    EventID IN (7045, 4697)
    OR (
      EventID = 1 AND (
        (CommandLine ILIKE '%sc.exe%' AND (CommandLine ILIKE '%create%' OR CommandLine ILIKE '%config%'))
        OR (CommandLine ILIKE '%powershell%' AND (CommandLine ILIKE '%New-Service%' OR CommandLine ILIKE '%Set-Service%'))
      )
    )
    OR (
      EventID IN (12, 13) AND
      RegistryPath ILIKE '%SYSTEM\\CurrentControlSet\\Services%' AND
      (
        RegistryPath ILIKE '%ImagePath%' OR
        RegistryPath ILIKE '%\\Start'
      )
    )
  )
  AND (
    suspicious_path = 1 OR lolbin_service = 1 OR unusual_parent = 1 OR EventID IN (7045, 4697)
  )
ORDER BY starttime DESC
LAST 24 HOURS

high severity high confidence

Detects Windows service creation and modification events using QRadar AQL against Windows Security Event Log (EventIDs 7045, 4697), Sysmon process creation (EventID 1 with sc.exe or PowerShell), and Sysmon registry events (EventIDs 12/13) targeting the Services registry hive. Scores events by suspicious path, LOLBin usage, and unusual parent process.

Data Sources

Windows Security Event LogSysmon Operational LogWindows System Event Log

Required Tables

events

False Positives & Tuning

Software deployment systems (SCCM, PDQ Deploy, Chocolatey) routinely create services — correlate with known software deployment windows and authorized maintenance accounts
Security monitoring agents (CrowdStrike Falcon, Cylance, Carbon Black) update their own services and may trigger registry modification alerts — build exclusions for signed binaries from known security vendors
Development and testing environments may have developers creating test services via PowerShell New-Service — separate production and non-production log source groups

Download portable Sigma rule (.yml)

Other platforms for T1543

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Create Malicious Windows Service via sc.exe
Expected signal: Security Event ID 4697 and System Event ID 7045: New service 'ArgusTestSvc' installed with ServiceFileName containing cmd.exe. Sysmon Event ID 1: sc.exe process creation with CommandLine containing 'create ArgusTestSvc'. Sysmon Event ID 13: Registry value set at HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestSvc\ImagePath.
Test 2Create Persistent Service via PowerShell New-Service
Expected signal: Sysmon Event ID 1: powershell.exe process creation with CommandLine containing 'New-Service'. Security Event ID 4697 and System Event ID 7045: service 'ArgusTestPSSvc' installed with ServiceFileName = powershell.exe. Sysmon Event ID 13: registry modification at HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestPSSvc\.
Test 3Service Installed in User-Writable Path
Expected signal: Sysmon Event ID 11: file created at %TEMP%\svchost32.exe (copy of cmd.exe). Sysmon Event ID 1: sc.exe execution with TEMP path in command line. Security Event ID 4697 / System Event ID 7045: new service with ServiceFileName in user Temp directory. Sysmon Event ID 13: ImagePath registry value containing \Temp\ path.
Test 4Modify Existing Service Binary Path (Service Hijacking)
Expected signal: Sysmon Event ID 1: sc.exe with 'config' and 'binPath' in command line targeting 'wuauserv'. Sysmon Event ID 13: registry value modification at HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\ImagePath. Security Event ID 4697 may fire depending on Windows version and audit policy. Note: this test modifies a real service — run only in isolated test environments.

Last updated: 2026-04-21 Research depth: deep

References (9)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1543 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Create or Modify System Process in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1543

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (5)

Related Techniques

Same Tactic: Persistence

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1543

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (5)

Related Techniques

Same Tactic: Persistence

Popular Detections

Get new detections in your inbox