Create or Modify System Process detection rulesT1543

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

windows

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

windows

Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

windows

Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

windows · file_event

Detects OilRig activity as reported by Nyotron in their March 2018 report

windows · process_creation

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

windows · registry_event

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

windows

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

windows

This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018

windows

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

windows · process_creation

Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.

macos · file_event

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

windows

Detects blocked load attempts of revoked drivers

windows

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

windows

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

windows · process_creation

Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device. This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.

windows · process_creation

Detects a driver load from a temporary directory

windows · driver_load

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

windows

Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8). In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.

linux · process_creation

Detects loading of known malicious drivers via their hash.

windows · driver_load

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

windows · registry_set

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

macos · process_creation

Detects a ProcessHacker tool that elevated privileges to a very high level

windows

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

windows · file_event

Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel. Potentially allowing for privilege escalation, persistence, or evasion of security controls.

windows · process_creation

Detects driver load of the Process Hacker tool

windows · driver_load

Detects service installation with suspicious folder patterns

windows

Detects a service installed by a client which has PID 0 or whose parent has PID 0

windows

Detects a service installed by a client which has PID 0 or whose parent has PID 0

windows

Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

windows

This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky

windows

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

windows · process_creation

Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable

windows · process_creation

Detects suspicious service installation commands

windows

Detects suspicious service installation scripts

windows

Detects service path modification via the "sc" binary to a suspicious command or path

windows · process_creation

Detects the creation of specific persistence files as observed in the LiteLLM PyPI supply chain attack. In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.

linux · file_event

This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET

windows

Detects loading of known vulnerable drivers via their hash.

windows · driver_load

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

windows · driver_load

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

windows · driver_load

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

macos · process_creation

Detects loading of known malicious drivers via the file name of the drivers.

windows · driver_load

Detects creation of a new service (kernel driver) with the type "kernel"

windows · process_creation

Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1

windows

Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines

windows

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

windows · process_creation

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

windows · process_creation

Detects driver load of the System Informer tool

windows · driver_load

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

windows · process_creation

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

windows

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

windows

Detects service installation in suspicious folder appdata

windows

Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.

windows · registry_set

Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering

windows · process_creation

Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

windows · process_creation

Detects a creation of systemd services which could be used by adversaries to execute malicious code.

linux

Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.

windows

Detects the creation of a new service using powershell.

windows · process_creation

Detects the creation of a new service using the "sc.exe" utility.

windows · process_creation

Detects the start, reload or restart of a service.

linux

Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors.

linux

Detects the load of known vulnerable drivers via the file name of the drivers.

windows · driver_load