Detect Create or Modify System Process in Microsoft Sentinel
Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters. Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1543 Create or Modify System Process
- Canonical reference
- https://attack.mitre.org/techniques/T1543/
KQL Detection Query
let SuspiciousServicePaths = dynamic([
"\\Temp\\", "\\AppData\\", "\\Downloads\\", "\\Public\\",
"\\Users\\Public\\", "%TEMP%", "%APPDATA%", "%PUBLIC%"
]);
let KnownLOLBins = dynamic([
"powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe",
"mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe",
"bitsadmin.exe", "wmic.exe", "msbuild.exe"
]);
// Branch 1: New service installation via sc.exe or PowerShell New-Service
let NewServiceCreation = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "sc.exe" and ProcessCommandLine has_any ("create", "config")
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("New-Service", "Set-Service", "sc.exe create"))
| extend DetectionType = "NewServiceCreation"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Branch 2: Service binary in suspicious path (registry write to Services key)
let SuspiciousServiceBinary = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services"
| where RegistryValueName =~ "ImagePath"
| where RegistryValueData has_any (SuspiciousServicePaths)
or RegistryValueData has_any (KnownLOLBins)
| extend DetectionType = "SuspiciousServiceBinaryPath"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryKey,
RegistryValueName, RegistryValueData, InitiatingProcessFileName,
InitiatingProcessCommandLine, DetectionType;
// Branch 3: Service installed by unusual parent (Office apps, script interpreters)
let UnusualParentService = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "sc.exe" and ProcessCommandLine has "create"
| where InitiatingProcessFileName in~ (
"winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
"wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe"
)
| extend DetectionType = "ServiceCreatedByOfficeOrScript"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Branch 4: New service type 0x10 (WIN32_OWN_PROCESS) with autostart via reg
let AutostartServiceReg = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services"
| where RegistryValueName =~ "Start" and RegistryValueData in ("2", "0") // Auto or Boot
| where InitiatingProcessFileName !in~ (
"services.exe", "svchost.exe", "msiexec.exe", "TrustedInstaller.exe",
"WmiPrvSE.exe", "MsMpEng.exe"
)
| extend DetectionType = "AutostartServiceRegistered"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryKey,
RegistryValueName, RegistryValueData, InitiatingProcessFileName,
InitiatingProcessCommandLine, DetectionType;
union NewServiceCreation, UnusualParentService
| sort by Timestamp descDetects creation or modification of Windows services using multiple detection branches: (1) sc.exe or PowerShell New-Service invocations, (2) suspicious ImagePath registry values pointing to writable user directories or LOLBins, (3) service creation initiated by Office applications or script interpreters, and (4) autostart service registry modifications by unexpected processes. Uses DeviceProcessEvents and DeviceRegistryEvents tables from Microsoft Defender for Endpoint.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software installers (MSI packages, vendor setup.exe) that register services during installation — typically identified by msiexec.exe or setup.exe as parent process
- IT management tools such as SCCM, Ansible, or Puppet that create or modify services as part of configuration management workflows
- Security products (EDR agents, AV engines, backup software) that install kernel-level or user-mode services during deployment or updates
- Software developers testing or deploying Windows services locally, particularly from development directories that may match suspicious path patterns
- System administrators manually configuring services via sc.exe or PowerShell during maintenance windows — correlate with change management tickets
Other platforms for T1543
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Malicious Windows Service via sc.exe
Expected signal: Security Event ID 4697 and System Event ID 7045: New service 'ArgusTestSvc' installed with ServiceFileName containing cmd.exe. Sysmon Event ID 1: sc.exe process creation with CommandLine containing 'create ArgusTestSvc'. Sysmon Event ID 13: Registry value set at HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestSvc\ImagePath.
- Test 2Create Persistent Service via PowerShell New-Service
Expected signal: Sysmon Event ID 1: powershell.exe process creation with CommandLine containing 'New-Service'. Security Event ID 4697 and System Event ID 7045: service 'ArgusTestPSSvc' installed with ServiceFileName = powershell.exe. Sysmon Event ID 13: registry modification at HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestPSSvc\.
- Test 3Service Installed in User-Writable Path
Expected signal: Sysmon Event ID 11: file created at %TEMP%\svchost32.exe (copy of cmd.exe). Sysmon Event ID 1: sc.exe execution with TEMP path in command line. Security Event ID 4697 / System Event ID 7045: new service with ServiceFileName in user Temp directory. Sysmon Event ID 13: ImagePath registry value containing \Temp\ path.
- Test 4Modify Existing Service Binary Path (Service Hijacking)
Expected signal: Sysmon Event ID 1: sc.exe with 'config' and 'binPath' in command line targeting 'wuauserv'. Sysmon Event ID 13: registry value modification at HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\ImagePath. Security Event ID 4697 may fire depending on Windows version and audit policy. Note: this test modifies a real service — run only in isolated test environments.
References (9)
- https://attack.mitre.org/techniques/T1543/
- https://technet.microsoft.com/en-us/library/cc772408.aspx
- https://learn.microsoft.com/en-us/windows/win32/services/service-control-manager
- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
- https://www.mandiant.com/resources/blog/iocs-yellow-liderc-imaploader
- https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira_0.pdf
- https://www.sans.org/white-papers/33492/
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set
Unlock Pro Content
Get the full detection package for T1543 including response playbook, investigation guide, and atomic red team tests.