T1543No distinct observable

Create or Modify System Process

Persistence · Privilege EscalationContainers, Linux, macOS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Every analytic in this brief is a named child's mechanism, and nothing parent-level is left once they are attributed. AN1575 is Windows services — Security EventID 4697 service creation, sc.exe/services.exe/ChangeServiceConfig invocation, and writes under HKLM\System\CurrentControlSet\Services — which is T1543.003, already published in this corpus from the same 4697 log source and the same ImagePath-style knob, so a rule here would be that rule re-tagged attack.t1543. AN1576 is systemd unit files under /etc/systemd/system, /etc/init.d writes and systemctl enable/start, which is T1543.002 (Systemd Service, DET0253/AN0701). […]

Covered instead by T1543.001, T1543.002, T1543.003, T1543.004, T1543.005.

What the technique is

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters. Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.

Read it on attack.mitre.org

What MITRE says you would watch

AN1575
Detects command-line or API-based creation/modification of Windows Services via sc.exe, powershell.exe, services.exe, or ChangeServiceConfig. Looks for creation/modification of autostart services via registry changes, file drops to System32\services, and anomalous parent-child process trees.
AN1576
Detects creation or modification of systemd service units, addition of cron jobs that invoke binaries on boot, or suspicious writes to /etc/init.d/. Monitors chmod +x and systemctl execution paths, especially from non-root parent processes.
AN1577
Detects creation or modification of LaunchDaemon or LaunchAgent plist files under /Library/LaunchDaemons/, ~/Library/LaunchAgents/, or similar. Monitors execution of launchctl, property list edits, and file permission changes.