Create or Modify System Process: Windows Service T1543.003
Tactics: Persistence, Privilege Escalation
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Events covered
20 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 117 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (63 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (6364 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (131 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 67 rules
- Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
- CobaltStrike Service Installations - Security
- CobaltStrike Service Installations - System
- CosmicDuke Service Installation
- Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
- Devcon Execution Disabling VMware VMCI Device
- Driver Load From A Temporary Directory
- EAP service activation by Liontail framework for DLL sideloading (via command)
- Encoded PowerShell payload deployed via service
- Impacket SMBexec service creation (registry)
- Impacket SMBexec service registration (native)
- Malicious Driver Load
- Malicious Driver Load By Name
- Mimikatz driver deployed via service
- Mimikatz driver registration (Reg via Sysmon)
- Moriya Rootkit - System
- Moriya Rootkit File Created
- New Kernel Driver Via SC.EXE
- New PDQDeploy Service - Client Side
- New PDQDeploy Service - Server Side
- New Service Creation Using PowerShell
- New Service Creation Using Sc.EXE
- OilRig APT Activity
- OilRig APT Registry Persistence
- OilRig APT Schedule Task Persistence - Security
- OilRig APT Schedule Task Persistence - System
- Possible impact of 'SMOKEDHAM backdoor' with MSDTC service privilege escalation via command line
- Potential CobaltStrike Service Installations - Registry
- Potential Persistence Attempt Via Existing Service Tampering
- ProcessHacker Privilege Elevation
- PSEXEC Remote Execution File Artefact
- PSexec service installation
- PUA - Kernel Driver Utility (KDU) Execution
- RDP session hijack via service creation abuse
- Remote Access Tool Services Have Been Installed - Security
- Remote Access Tool Services Have Been Installed - System
- Service abuse with backdoored "command failure" (Reg via command)
- Service abuse with backdoored "command failure" (Reg via PowerShell)
- Service abuse with backdoored "command failure" (service)
- Service abuse with malicious ImagePath (Reg via PowerShell)
- Service abuse with malicious ImagePath (service)
- Service creation (command)
- Service creation (PowerShell)
- Service Installation in Suspicious Folder
- Service Installation with Suspicious Folder Pattern
- Service permissions hijacked for privileges abuse (PowerShell)
- Service permissions hijacked for privileges abuse (reg via command)
- Service permissions hijacked for privileges abuse (Reg via PowerShell)
- Service permissions hijacked for privileges abuse (service)
- ServiceDll Hijack
- Sliver C2 Default Service Installation
- Special File Creation via Mknod Syscall
- StoneDrill Service Install
- Suspicious New Service Creation
- Suspicious Service DACL Modification Via Set-Service Cmdlet
- Suspicious Service Installation
- Suspicious Service Installation Script
- Suspicious Service Path Modification
- Sysinternals PsService Execution
- Sysinternals PsSuspend Execution
- Turla PNG Dropper Service
- Turla Service Install
- Uncommon Service Installation Image Path
- Vulnerable Driver Load
- Vulnerable Driver Load By Name
- Vulnerable HackSys Extreme Vulnerable Driver Load
- Vulnerable WinRing0 Driver Load
Elastic 24 rules
- Anomalous Process For a Linux Population
- Creation or Modification of a new GPO Scheduled Task or Service
- Execution of an Unsigned Service
- First Time Seen Driver Loaded
- Persistence via Update Orchestrator Service Hijack
- Persistence via WMI Standard Registry Provider
- Potential Privilege Escalation via Service ImagePath Modification
- Remote Windows Service Installed
- Service Command Lateral Movement
- Service Control Spawned via Script Interpreter
- Service Creation via Local Kerberos Authentication
- Service DACL Modification via sc.exe
- Service Path Modification
- Service Path Modification via sc.exe
- Suspicious ImagePath Service Creation
- Suspicious ScreenConnect Client Child Process
- Suspicious Service was Installed in the System
- System Shells via Services
- Unsigned DLL Loaded by Svchost
- Unusual Persistence via Services Registry
- Unusual Process For a Windows Host
- Unusual Windows Path Activity
- Unusual Windows Service
- Windows Service Installed via an Unusual Client
Splunk 23 rules
- CMD Echo Pipe - Escalation
- Driver Loaded from Unusual Path - Windows (Sysmon)
- Impacket Lateral Movement Commandline Parameters
- Impacket Lateral Movement smbexec CommandLine Parameters
- Impacket Lateral Movement WMIExec Commandline Parameters
- Kernel Service Installed - Windows (Windows Event Log)
- Possible Lateral Movement PowerShell Spawn
- PSexec Service Creation (Windows Event Log)
- Randomly Generated Windows Service Name
- Services LOLBAS Execution Process Spawn
- Suspicious .sys Created - Windows (Sysmon)
- Windows Bluetooth Service Installed From Uncommon Location
- Windows KrbRelayUp Service Creation
- Windows Remote Create Service
- Windows Service Create Kernel Mode Driver
- Windows Service Create RemComSvc
- Windows Service Create with Tscon
- Windows Service Creation on Remote Endpoint
- Windows Service Initiation on Remote Endpoint
- Windows Suspicious Driver Loaded Path
- Windows Vulnerable Driver Installed
- Windows Vulnerable Driver Loaded
- XMRIG Driver Loaded