T1543.003 — Windows Service

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path…

Sub-technique of Create or Modify System Process (T1543).

Sigma detection rules (1)

T1543.003 Create or Modify System Process: Windows Service

title: "T1543.003 Create or Modify System Process: Windows Service"
id: c97d7644-3ab9-43a1-b2b1-42996facc84d
description: 'Detection of Windows Service Creation or Modification. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: ServiceNamePattern, ImagePathFilter, DriverExtensionList, StartupTypeChangeWindow, UnsignedBinaryAlert.'
references:
  - https://attack.mitre.org/techniques/T1543/003
author: Shahrukh Khan
date: 2026-06-13
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\sc.exe'
    CommandLine|contains|all:
      - 'create'
      - 'binPath'

  filter_temp_path:
    CommandLine|contains:
      - '\Windows\Temp\'
      - '\Users\Public\'
      - '\AppData\Local\Temp\'

  condition: selection and filter_temp_path

falsepositives:
  - Legitimate installers that stage a service binary in a temp path before relocating it; verify the resulting service's final binary location and signature.

level: high

Related sub-techniques

Explore