Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons) 

Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.  

Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection)  
Create or Modify System Process
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1543  external_id: T1543     source_name: AppleDocs Launch Agent Daemons  description: Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.  url: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html     source_name: TechNet Services  description: Microsoft. (n.d.). Services. Retrieved June 7, 2016.  url: https://technet.microsoft.com/en-us/library/cc772408.aspx     source_name: OSX Malware Detection  description: Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved July 10, 2017.  url: https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf     