CmdID

CmdID / Techniques

T1543 Create or Modify System Process

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. MITRE ATT&CK

2 Sigma rules T1543 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1543.001Create or Modify System Process: Launch Agent
T1543.002Create or Modify System Process: Systemd Service
T1543.003Create or Modify System Process: Windows Service
T1543.004Create or Modify System Process: Launch Daemon

Sigma rules tagged with it

process creation, the highest levels first
mediumPUA - Process Hacker ExecutionFlorian Roth (Nextron Systems) · Windows
mediumPUA - System Informer ExecutionFlorian Roth (Nextron Systems) · Windows