RMMProject - Rogue Service Creation (T1543.003)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•2•0•16

Identifies the malicious RMM establishing persistence by creating a system service configured to auto-start the backdoor on reboot. The rule specifically looks for the 'sc.exe' utility being used to create a service with a binary path pointing to an executable within the 'AppData' directory and configured for automatic startup.