ATT&CK coverage › Technique
Create or Modify System Process: Windows Service T1543.003
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Events covered
9 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 50 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (30 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (5856 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Common exclusions (44 distinct)
Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 37 rules
- Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
- CobaltStrike Service Installations - Security
- CobaltStrike Service Installations - System
- Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
- Devcon Execution Disabling VMware VMCI Device
- Driver Load From A Temporary Directory
- Malicious Driver Load
- Malicious Driver Load By Name
- Moriya Rootkit - System
- New Kernel Driver Via SC.EXE
- New PDQDeploy Service - Client Side
- New PDQDeploy Service - Server Side
- New Service Creation Using PowerShell
- New Service Creation Using Sc.EXE
- Potential CobaltStrike Service Installations - Registry
- Potential Persistence Attempt Via Existing Service Tampering
- ProcessHacker Privilege Elevation
- PSEXEC Remote Execution File Artefact
- PUA - Kernel Driver Utility (KDU) Execution
- Remote Access Tool Services Have Been Installed - Security
- Remote Access Tool Services Have Been Installed - System
- Service Installation in Suspicious Folder
- Service Installation with Suspicious Folder Pattern
- ServiceDll Hijack
- Sliver C2 Default Service Installation
- Suspicious New Service Creation
- Suspicious Service DACL Modification Via Set-Service Cmdlet
- Suspicious Service Installation
- Suspicious Service Installation Script
- Suspicious Service Path Modification
- Sysinternals PsService Execution
- Sysinternals PsSuspend Execution
- Uncommon Service Installation Image Path
- Vulnerable Driver Load
- Vulnerable Driver Load By Name
- Vulnerable HackSys Extreme Vulnerable Driver Load
- Vulnerable WinRing0 Driver Load
Elastic 4 rules
- Remote Windows Service Installed
- Service Creation via Local Kerberos Authentication
- Suspicious Service was Installed in the System
- Windows Service Installed via an Unusual Client
Splunk 8 rules
- Randomly Generated Windows Service Name
- Windows Bluetooth Service Installed From Uncommon Location
- Windows KrbRelayUp Service Creation
- Windows Service Create RemComSvc
- Windows Suspicious Driver Loaded Path
- Windows Vulnerable Driver Installed
- Windows Vulnerable Driver Loaded
- XMRIG Driver Loaded