Create or Modify System Process

What is Create or Modify System Process?

“Create or Modify System Process is documented as technique T1543 in MITRE ATT&CK® v19.1 under the Persistence tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Create or Modify System Process activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor Windows Registry paths HKLM\SYSTEM\CurrentControlSet\Services for new service entries and compare against authorized software inventory, alerting on services with executable paths in user-writable locations or temp directories.

2. 2

   Track changes to systemd unit files in /etc/systemd/system/ and /lib/systemd/system/ on Linux systems using file integrity monitoring, alerting on new or modified unit files that execute scripts from non-standard paths.

3. 3

   Detect service creation using unrecognized or unsigned service binaries by correlating service executable paths with known good software inventory and digital signature validation databases.

4. 4

   Monitor for services configured with unusual recovery options such as restarting with different executables on failure, which can be used to establish redundant execution mechanisms that survive if the primary service is stopped.

5. 5

   Alert on service creation or modification events occurring outside of authorized change management windows, particularly on production systems where service changes should follow a controlled deployment process.

Example Alerts

These realistic alert examples show what Create or Modify System Process looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Create or Modify System Process?

Detection centers on XDR, SIEM telemetry for the persistence phase of the attack. Monitor Windows Registry paths HKLM\SYSTEM\CurrentControlSet\Services for new service entries and compare against authorized software inventory, alerting on services with executable paths in user-writable locations or temp directories. Track changes to systemd unit files in /etc/systemd/system/ and /lib/systemd/system/ on Linux systems using file integrity monitoring, alerting on new or modified unit files that execute scripts from non-standard paths.

What does a Create or Modify System Process alert look like?

A representative XDR detection is "New System Service Installed with Suspicious Binary" (high severity): New Windows service registered with binary path C:\Windows\Temp\sysmonitor64.exe. The executable is not digitally signed, was created 2 minutes before service registration, and its hash matches a known remote access trojan variant. The service description reads "Windows System Monitor Service" mimicking legitimate monitoring tools. The service is configured to start automatically as LocalSystem.

Which tools detect Create or Modify System Process, and how can I practice?

Create or Modify System Process (T1543) is best surfaced with XDR, SIEM telemetry, which exposes the persistence signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.