T1543PersistencePrivilege Escalation
Create or Modify System Process
Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services. On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system…
CVEs11
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.11
Reports1
Detections
9 Sigma rules tagged T1543Create or Modify System ProcessT15439 general rules
- CodeIntegrity - Blocked Driver Load With Revoked Certificatehightest
- CodeIntegrity - Blocked Image/Driver Load For Policy Violationhightest
- KrbRelayUp Service Installationhightest
- PUA - Process Hacker Driver Loadhightest
- Service Installed By Unusual Client - Securityhightest
- Service Installed By Unusual Client - Systemhightest
- PUA - Process Hacker Executionmediumtest
- PUA - System Informer Driver Loadmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Create or Modify System Process
11 CVEs, by priority. Each link shows its badge.- CVE-2024-4577PHP-CGI OS Command Injection VulnerabilityPHP Group · PHPKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+10 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%79.9priority
- CVE-2021-45382D-Link Multiple Routers Remote Code Execution VulnerabilityD-Link · Multiple RoutersKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+4 moreMITRE CTID mapping of the KEV entry · follow-on activity97.8%Top 0.09%69.8priority
- CVE-2025-33053Microsoft Windows External Control of File Name or Path VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 8.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · follow-on activity87.0%Top 0.25%69.1priority
- CVE-2025-4428Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityIvanti · Endpoint Manager Mobile (EPMM)KEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 moreMITRE CTID mapping of the KEV entry · follow-on activity88.0%Top 0.24%69.1priority
- CVE-2024-49138Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1543Create or Modify System ProcessT1068Exploitation for Privilege EscalationAI mapping from the description · primary impact26.2%Top 2%68.1priority
- CVE-2024-35250Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1543Create or Modify System ProcessT1068Exploitation for Privilege EscalationAI mapping from the description · primary impact25.2%Top 2.1%68.0priority
- CVE-2023-0386Linux Kernel Improper Ownership Management VulnerabilityLinux · KernelKEVPublic exploitHigh · 7.8T1543Create or Modify System ProcessT1548.001Setuid and SetgidMITRE CTID mapping of the KEV entry · primary impact7.9%Top 5.3%67.4priority
- CVE-2025-32706Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · primary impact2.3%Top 16%65.2priority
- CVE-2025-32709Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · primary impact1.8%Top 21%64.2priority
- CVE-2023-44221SonicWall SMA100 Appliances OS Command Injection VulnerabilitySonicWall · SMA100 AppliancesKEVHigh · 7.2T1059.004Unix ShellT1543Create or Modify System Process+2 moreMITRE CTID mapping of the KEV entry · follow-on activity76.3%Top 0.46%62.9priority
- CVE-2025-32701Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityMicrosoft · WindowsKEVHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · primary impact1.4%Top 27%58.0priority