Create or Modify System Process: Windows Service sub-technique

Create or Modify System Process

Create or Modify System Process ranks third this year thanks in large part to detections associated with its Windows Service sub-technique.

Editors’ note: While the analysis and detection opportunities remain applicable, this technique page was written for a previous Threat Detection Report and has not been updated in 2022.

Pairs with this song

Prevalent Sub-techniques

T1543.003

Windows Service

4.9%

organizations affected

3,324

confirmed threats

Typically, Windows services automatically run with elevated privileges during the boot cycle of the operating system, granting adversaries a means of both persistence and privilege escalation.