T1543.003 Create or Modify System Process: Windows Service

2 threats tracked by Spectrum Delta use this technique.

T1543.003 on MITRE ATT&CK →

• Lazarus FlashHole

  Masqueraded service from copied system binary

  System log 7045 service installs with ImagePath under RasConv; Sysmon EID 11 for the copied binary; EID 1 for ImeBroker.exe execution

  Seen in: Windows System/Security event logs, Sysmon / EDR

• MythicRatatoskr Yggdrasil C2

  MythicRatatoskr installed as Windows service ieupdate

  System log 7045 service installs; service control events for ieupdate/updater.exe/WindowsDefenderSvc.exe

  Seen in: Windows System/Security event logs