DET0552: Detection of Windows Service Creation or Modification
This detection strategy matters because Windows service creation or modification is a durable way for an intruder to regain execution after reboot and pote...
Analyst context for executives and security teams
This detection strategy matters because Windows service creation or modification is a durable way for an intruder to regain execution after reboot and potentially run with elevated privileges. For leaders, the value is not just alerting on a new service; it is proving the organization can distinguish authorized administrative change from suspicious persistence activity before an incident becomes harder to contain.
Executive priority
Prioritize this as a Windows resilience and incident-readiness control tied to persistence and privilege escalation. Security leaders should ask whether service changes on critical Windows systems are logged, reviewed, and explainable; whether SOC teams can rapidly identify who changed a service and what executable path was configured; and whether incident responders have enough evidence to scope persistence during containment. This also supports audit and compliance evidence around privileged change monitoring.
Technical view
DET0552 detects ATT&CK technique T1543.003, Windows Service. SOC and detection engineering teams should validate monitoring for creation and modification of Windows services, especially changes to service executable paths, recovery commands, and related Registry-backed configuration. Detection logic should be aligned to the related tactics of persistence and privilege escalation, and should support triage questions such as: what service changed, what binary or command will run, what account or process made the change, and whether the change matches expected administrative activity.
Likely telemetry
- Windows service creation and service configuration change events
- Windows Registry change telemetry for service configuration data
- Process execution telemetry showing tools or processes that create or modify services
- Endpoint security/EDR records for service install, modification, and startup behavior
- Host identity context showing the user, account, or process responsible for the change
Detection direction
- Confirm that Windows service creation and modification events are collected from relevant Windows endpoints and retained long enough for incident response.
- Tune for unauthorized, unusual, or poorly explained service executable paths and recovery command changes rather than treating every service change as malicious.
- Correlate service changes with process execution, account context, and asset criticality to reduce false positives from legitimate software installation, patching, and administration.
- Validate that detection content covers both newly installed services and modifications to existing services, since the related technique includes both behaviors.
- Ensure triage output preserves the service name, configured command or executable path, modifying account/process, host, and timestamp.
Mitigation priorities
- Establish a baseline and change-control expectation for Windows service configuration on important systems.
- Restrict who can create or modify services through least-privilege administration and privileged access governance.
- Harden monitoring and alert routing for service changes on critical Windows assets first, then expand coverage based on risk.
- During incident response, review service configuration and Registry-backed service paths as part of persistence scoping.
- Use detection results as evidence for control validation, not as proof of complete coverage unless local telemetry and tuning have been tested.
Analyst notes and limits
The supplied ATT&CK object is a detection strategy with no official description or detection text, but it has a direct relationship indicating it detects T1543.003 Windows Service. The practical guidance therefore focuses on defensive validation for Windows service creation or modification and the related persistence and privilege-escalation context.
Platforms and tactics are not specified on the detection strategy itself; Windows, persistence, and privilege escalation come from the related ATT&CK technique. No vendor-specific telemetry, detection analytic, severity, adversary attribution, or active exploitation claim is provided in the supplied fields, so local environment testing is required.
Detection of Windows Service Creation or Modification
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1543.003 | Windows Service Sub-technique | This object detects Windows Service. |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | d71e5b6420d9… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack DET0552Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.