T1543 — Create or Modify System Process

# T1543 - Create or Modify System Process

## SOC Recommendation
Investigate Create or Modify System Process activity in the context of Persistence/Privilege Escalation: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Monitor for File Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Content Filtering | Isolate | Apply Content Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Stop and delete the malicious service: sc stop <name> then | Low | No | Yes |
| Delete or quarantine the service binary | Low | No | Yes |
| If PsExec: investigate the origin host — it is the attacker' | Low | No | Yes |
| Check for additional services created in the same time windo | Low | Yes | No |

## KQL
```kql
DeviceEvents
| where ActionType has "ExploitGuardNonMicrosoftSignedBlocked"
| where InitiatingProcessFileName has "svchost.exe" and FileName has "NetSetupSvc.dll"
| extend HashAlgorithm = "SHA1"
| extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)
```
```kql
Pathlock_TDnR_CL
| where DataSource == "OS_CMD_CHANGES"
| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs
```
```kql
Pathlock_TDnR_CL
| where DataSource == "TRANSPORT_LOG"
| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs
```

## Escalation Criteria
- Create or Modify System Process activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1543.json
• /api/recommendations/T1543.json
• /api/d3fend/T1543.json
• /api/mappings/T1543.json
• /api/confluence/T1543.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1543.json

Response:

{
  "technique_id": "T1543",
  "name": "Create or Modify System Process",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Persistence",
    "Privilege Escalation"
  ],
  "platforms": [
    "Containers",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services...",
  "soc_recommendation": "Investigate Create or Modify System Process activity in the context of Persistence/Privilege Escalation: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for File Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-CF",
      "name": "Content Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Content Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed create or modify system process activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"TEARDROP memory-only dropper\" -- Identifies SolarWinds TEARDROP memory-only dropper IOCs in Window's defender Exploit Guard activity References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f"
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Stop and delete the malicious service: sc stop <name> then",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Stop and delete the malicious service: sc stop <name> then sc delete <name>"
    },
    {
      "name": "Delete or quarantine the service binary",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "If PsExec: investigate the origin host — it is the attacker'",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "If PsExec: investigate the origin host — it is the attacker's current position"
    },
    {
      "name": "Check for additional services created in the same time windo",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Check for additional services created in the same time window"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "738702fd-0a66-42c7-8586-e30f0583f8fe — TEARDROP memory-only dropper",
        "description": "Identifies SolarWinds TEARDROP memory-only dropper IOCs in Window's defender Exploit Guard activity References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "DeviceEvents\n| where ActionType has \"ExploitGuardNonMicrosoftSignedBlocked\"\n| where InitiatingProcessFileName has \"svchost.exe\" and FileName has \"NetSetupSvc.dll\"\n| extend HashAlgorithm = \"SHA1\"\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)"
      },
      {
        "name": "2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c38 — Pathlock TDnR - Logical OS Command Changes",
        "description": "Detects changes to logical OS command definitions in SAP (transaction SM49), forwarded by Pathlock Threat Detection and Response. Modifications to OS commands may enable arbitrary OS-level code execution within the SAP system context, representing a critical escalation vector. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "Pathlock_TDnR_CL\n| where DataSource == \"OS_CMD_CHANGES\"\n| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,\n          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,\n          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs"
      },
      {
        "name": "2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c71 — Pathlock TDnR - TMS Transport and Import Events",
        "description": "Detects SAP Transport Management System (TMS) transport and import events, forwarded by Pathlock Threat Detection and Response. Unauthorized transports may introduce malicious code changes, configuration weaknesses, or backdoors into production SAP systems, bypassing normal change management and approval processes. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "Pathlock_TDnR_CL\n| where DataSource == \"TRANSPORT_LOG\"\n| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,\n          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,\n          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "d9bfa475-270d-4b07-93cb-b1f49abe13da — Suspicious Echo or Printf Execution Detected via Defend for Containers",
        "description": "(EQL) This rule detects the execution of the echo/printf command to write data to potential persistence files, decode base64/32/16 and hex content or establish connections to a potential C2. The echo/printf commands are used to display a line of text or write data to a file... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where event.type == \"start\" and event.action == \"exec\" and process.interactive == true and\nprocess.name in (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and\nprocess.args in (\"-lc\", \"-c\", \"-cl\") and process.args like (\"*echo *\", \"*printf *\") and\nprocess.args like (\n  \"*/etc/cron*\", \"*/etc/rc.local*\", \"*/dev/tcp/*\", \"*/etc/init.d*\", \"*/etc/update-motd.d*\",\n  \"*/etc/ld.so*\", \"*/etc/sudoers*\", \"*base64 *\", \"*base32 *\", \"*base16 *\", \"*/etc/profile*\",\n  \"*/dev/shm/*\", \"*/etc/ssh*\", \"*/home/*/.ssh/*\", \"*/root/.ssh*\" , \"*~/.ssh/*\", \"*xxd *\",\n  \"*/etc/shadow*\", \"* /tmp/*\", \"* /var/tmp/*\", \"* /dev/shm/* \", \"* ~/*\", \"* /home/*\",\n  \"* /run/*\", \"* /var/run/*\", \"*|*sh\", \"*|*python*\", \"*|*php*\", \"*|*perl*\", \"*|*busybox*\",\n  \"*/var/www/*\", \"*>*\", \"*;*\", \"*chmod *\", \"*rm *\", \"*openssl enc*\"\n) and container.id like \"?*\""
      },
      {
        "name": "e3f5a566-df31-40cc-987c-24bc4bb94ba5 — Persistence via a Hidden Plist Filename",
        "description": "(EQL) Identifies the creation of a hidden launch agent or daemon property list file. An adversary may establish persistence by installing a new launch agent or daemon which executes at login. Hidden plist files with filenames starting with a dot are particularly suspicious. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "file where host.os.type == \"macos\" and event.type != \"deletion\" and\n  file.path like~ (\n    \"/System/Library/LaunchAgents/.*.plist\",\n    \"/Library/LaunchAgents/.*.plist\",\n    \"/Users/*/Library/LaunchAgents/.*.plist\",\n    \"/System/Library/LaunchDaemons/.*.plist\",\n    \"/Library/LaunchDaemons/.*.plist\"\n  ) and\n  not (file.name like \".chef-com*.plist\" and process.executable like \"/opt/chef/embedded/bin/ruby\") and\n  not (process.executable in (\"/usr/bin/sed\", \"/bin/bash\") and file.name like \".!*!*.plist\")"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Create or Modify System Process activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1543 - Create or Modify System Process Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}