Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Persistence/ T1543.003

T1543.003Windows Service

T1543.003 — Windows Service is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 46 detection use cases covering it and 21 threat-intel articles citing it.

PersistencePrivilege Escalation
View on the matrix → Filter Detection Library MITRE official spec ↗
46Use cases
21Articles
0Sub-techniques
2Tactics
↑ Parent technique: T1543 · Create or Modify System Process

Use cases covering this technique (46)

Service install for persistence — sc.exe / new service registry write Internal install · hunting DSΣP CMD Echo Pipe - Escalation ESCU actions · alerting P Impacket Lateral Movement Commandline Parameters ESCU actions · alerting P Impacket Lateral Movement smbexec CommandLine Parameters ESCU actions · alerting P Impacket Lateral Movement WMIExec Commandline Parameters ESCU actions · alerting P Possible Lateral Movement PowerShell Spawn ESCU actions · hunting P Randomly Generated Windows Service Name ESCU actions · hunting P Services LOLBAS Execution Process Spawn ESCU actions · alerting P Windows Admin Password Changed by Non-Admin ESCU actions · alerting P Windows Bluetooth Service Installed From Uncommon Location ESCU actions · hunting P Windows Cloud Files Filter Loaded by Uncommon Process ESCU actions · hunting P Windows KrbRelayUp Service Creation ESCU actions · alerting P Windows MsMpEng Writing to System32 ESCU actions · alerting P Windows Remote Create Service ESCU actions · hunting P Windows Service Create Kernel Mode Driver ESCU actions · alerting P Windows Service Create RemComSvc ESCU actions · hunting P Windows Service Create with Tscon ESCU actions · alerting P Windows Service Creation on Remote Endpoint ESCU actions · alerting P Windows Service Initiation on Remote Endpoint ESCU actions · alerting P Windows Suspicious Driver Loaded Path ESCU actions · alerting P Windows Vulnerable Driver Installed ESCU actions · alerting P Windows Vulnerable Driver Loaded ESCU actions · hunting P XMRIG Driver Loaded ESCU actions · alerting P Sc exe Manipulating Windows Services ESCU actions · alerting P Suspicious Driver Loaded Path ESCU actions · alerting P Windows Service Created Within Public Path ESCU actions · alerting P Article-specific behavioural hunt — Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth Bespoke exploit · hunting DSP [LLM] CoolClient signed kernel rootkit msagent.sys dropped and registered as 'msagent' driver service Bespoke install · hunting DSΣPDDCS [LLM] CoolClient persistence: 'goopdate' Run key and 'media_updaten' service creation Bespoke install · hunting DSΣPDDCS Article-specific behavioural hunt — APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Window Bespoke exploit · hunting DSP [LLM] CoolClient signed kernel rootkit: msagent.sys driver service install (Nanjing Ranyi cert) Bespoke install · alerting DSΣPDDCS [LLM] Still Sync TReload service persistence + implant CLI flags (--firefly/--console) Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to d Bespoke exploit · hunting DSP Article-specific behavioural hunt — CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware deliver Bespoke exploit · hunting DSP [LLM] CornFlake RAT persistence via svchost32.exe masquerade in %APPDATA% Bespoke install · alerting DSΣPDDCS [LLM] Trojanized MeshAgent running outside its install path (Sinobi ransomware C2) Bespoke c2 · alerting DSΣPDDCS [LLM] Zoho Assist Unattended Agent deployment (Warlock / Storm-2603 ransomware) Bespoke install · alerting DSΣPDDCS [LLM] OctLurk/LurkProxy loader service registration (ServiceMain=RegisterService loading oleasapi.dll/msbasesysdc.dll) Bespoke install · alerting DSΣPDDCS [LLM] Trojanized MeshAgent installed as SYSTEM auto-start service (Sinobi covert C2) Bespoke install · alerting DSΣDDCS [LLM] Zoho Assist Unattended Agent deployment for headless remote access (Warlock / Storm-2603) Bespoke install · alerting DSΣDDCS Article-specific behavioural hunt — Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analy Bespoke exploit · hunting DSP [LLM] fast16 kernel driver (fast16.sys) drop / load — sabotage patching engine Bespoke install · alerting DSΣPDDCS [LLM] easy-day-js Windows persistence: Run key 'NvmProtocal' / protocal.cjs autostart Bespoke install · alerting DSΣPDDCS [LLM] SprySOCKS WIN_DRV/WIN_PLUS backdoor binary by ESET SHA1 hash Bespoke install · hunting DSΣPDDCS Article-specific behavioural hunt — EDR killers explained: Beyond the drivers Bespoke exploit · hunting DSP Article-specific behavioural hunt — Setting up SSL/TLS for Kubernetes Ingress Bespoke install · hunting DSP

Articles citing this technique (21)

high Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth art-43
crit APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit art-48
high Armored Likho expands its cyber-espionage toolkit art-62
crit Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference part art-87
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit You were onto something with “It’s the Climb,” Miley art-165
crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
high Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? art-223
high Everybody's shipping code they can't read art-345
med FishMonger’s arsenal upgraded: SprySOCKS for Windows art-375
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
crit EDR killers explained: Beyond the drivers art-613
high Secure by Design: The Future of Threat Modeling for AI-Native Applications art-815
med Top takeaways from re:Invent 2022 art-1908
high Setting up SSL/TLS for Kubernetes Ingress art-1934
med Security Horror Story: Accidentally exposing PII data art-3084
high Trend Micro launches Cloud One Open Source Security powered by Snyk art-3186
high Navigate 3 trends in financial services with DevSecOps art-3355
med Understanding Amazon S3 security and compliance on AWS art-3545
high Immutable infrastructure: Networks art-3718