Create or Modify System Process

Named by 2 kept items in this workspace.

Search every workspace for Create or Modify System Process. It matches the name as written, so it can find other things that share it.

The items that name it 2

Phishing Abuses RMM Tools for Persistent Access
writeup2026-09-29It is written here as Create or Modify System Process: Windows Service.
MSP360 and ScreenConnect installed as Windows services to establish persistent access.
Socket: Operation Muck and Load
writeup2026-07-16It is written here as Create or Modify System Process: Windows Service.
Service activity used for persistence.

All techniques in this workspace.